{ "Event": { "published": true, "date": "2026-03-08", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2026-03-08", "timestamp": 1773014581, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "2ed673dd-fd92-45b6-bc6c-23af63f1584a", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c15fe881-1b37-11f1-a769-42010a9c0008", "comment": "Malware payload (ArcaneStealer)", "timestamp": 1773006170, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773006170, "uuid": "787e057f-1190-4099-9bd3-6ddd8d1d426b", "comment": "Malware payload (ArcaneStealer)", "value": "7537fe40bc74718a5527521cc9ace81e", "object_relation": "md5", "Tag": [ { "name": "ArcaneStealer", "colour": "#884033", "exportable": true, "hide_tag": false }, { "name": "Dacic", "colour": "#229061", "exportable": true, "hide_tag": false }, { "name": "Dacicstealer", "colour": "#64EEFC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773006170, "uuid": "9c8b7d77-6635-4622-828c-dba86bbb1fd0", "comment": "Malware payload (ArcaneStealer)", "value": "00069fdfdc842d76fb5440ac4a64ad01a7d1b8b5240b0b9bb716d983821e46d1", "object_relation": "sha256", "Tag": [ { "name": "ArcaneStealer", "colour": "#884033", "exportable": true, "hide_tag": false }, { "name": "Dacic", "colour": "#229061", "exportable": true, "hide_tag": false }, { "name": "Dacicstealer", "colour": "#64EEFC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773006170, "uuid": "8748bcfe-78f4-4080-8ed6-8a1648568ef2", "comment": "Malware payload (ArcaneStealer)", "value": "772e4b6dc64ba08ea5a666e442c881b7176fa3a6", "object_relation": "sha1", "Tag": [ { "name": "ArcaneStealer", "colour": "#884033", "exportable": true, "hide_tag": false }, { "name": "Dacic", "colour": "#229061", "exportable": true, "hide_tag": false }, { "name": "Dacicstealer", "colour": "#64EEFC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773006170, "uuid": "fb99e2bc-7877-4e3e-9087-ff804d6c316e", "comment": "Malware payload (ArcaneStealer)", "value": "7ed3286f07f58605d48a98bd13aabf2975c9b55db7c83a78b40c88ff60f5edd59f78885425dc58813a1a9543eb6e3a65", "object_relation": "sha3-384", "Tag": [ { "name": "ArcaneStealer", "colour": "#884033", "exportable": true, "hide_tag": false }, { "name": "Dacic", "colour": "#229061", "exportable": true, "hide_tag": false }, { "name": "Dacicstealer", "colour": "#64EEFC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773006170, "uuid": "b94b505d-8c19-4e22-adaa-91e532d8fdb3", "value": "T16BB31287C0F6CD94E735867A6521998CCE52ADE3998F8351E579E22F3F080D3780369A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773006170, "uuid": "fe73eeb1-a6f4-4a4a-b65b-af901e832d9c", "value": "8efd347d961f811985fc96a4b4c4393f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773006170, "uuid": "9da674a0-13ff-4064-8457-7983fa004216", "value": "1536:OCZTaLxMAIk713nf4uhTXPP1FKF1FhYAKAYvmnNT0+nAi06fNwXj4BYAXM/cB7Uz:1JBAjdf/dXnzKRhjKAloXowEBTB4z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773006170, "uuid": "ab3726a5-84c7-443e-9960-25baa71c422c", "value": 109056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773006170, "uuid": "f83175d6-f5a6-46af-afa0-cb2b215f27be", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773006170, "uuid": "615eef09-9a24-4aa8-a0de-8ef5e38490e9", "value": "RaketaFix.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d4e9710-1abf-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772954328, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772954328, "uuid": "b1e54655-16f4-442c-9877-803e3b06feeb", "comment": "Malware payload (Mirai)", "value": "7db551c272e224f7c1180b90b651311c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772954328, "uuid": "c96c2f71-69b6-41ed-8c5d-2f6efd397164", "comment": "Malware payload (Mirai)", "value": "0022b8de27d1a1cdc91f3ba895f261023d597c9a2617131f89ce13d93e29e309", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772954328, "uuid": "53e091a2-b2f4-4e41-a6db-a3d45f7f00d8", "comment": "Malware payload (Mirai)", "value": "a8579225bf0fd9bf16f45f6774d92b98f212754b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772954328, "uuid": "863b0a0b-2712-46e9-b1eb-24c5a9ef12ad", "comment": "Malware payload (Mirai)", "value": "2fefe94cfe753b09479fb03f2a35cdd9695a7303f9e559da1a60b80ba23be9e70e5b89b1c5ab25bfe2440590dfe68a45", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772954328, "uuid": "74786d68-f571-4c69-9cb3-23865027020e", "value": "T1E2E34A55B8828A22C9D513BEF92E018E331327A8E2DF7213DD215F2577C792B0D77A52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772954328, "uuid": "e57b2040-eaed-40b6-9142-28637f7328a4", "value": "3072:GRp26H+t6SCysDD4D6Ie1k6aUfzL6EiueCo2kSa:m26et6SCHDDceS6aGIueckS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772954328, "uuid": "fdbead91-970b-4ede-bbc5-bd51fe3f178d", "value": 146272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772954328, "uuid": "e69b1421-01d2-493e-a056-557efb2d16d0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772954328, "uuid": "fe07daf0-f873-4d19-9705-252d1267e8a5", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "523d1bb3-1b33-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773004266, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773004266, "uuid": "27327aff-9930-4929-9768-f1a892fb8d96", "comment": "Malware payload (Mirai)", "value": "0f6decfd4cc8b24de67f50fb56161cce", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773004266, "uuid": "2b47abf5-9dfa-4d25-a8f1-aa7e1622b7e4", "comment": "Malware payload (Mirai)", "value": "00dc7020c9bd7dddcfa67c791cc1e0d1c78f8eee73d385174913dab518f95bba", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773004266, "uuid": "9939320f-159a-40da-87a8-17b47066710e", "comment": "Malware payload (Mirai)", "value": "adc3593f7b0f2dcd27d7ec48ad6b55fe09eb93bf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773004266, "uuid": "b314f86d-d2e7-4d42-a984-c46748855634", "comment": "Malware payload (Mirai)", "value": "0b179027593195b08573503586cba61b251e27d6dad8eba02dde5d5ae90dc0a71169c38038fa1bafb2f9f15abf776d59", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773004266, "uuid": "fddaf269-a988-412b-a3ff-224609b89abb", "value": "T1B7241A85EA41BF63C0C36BB9F6DBC20133B39754E3E763059518AFB03B8679A4E16506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773004266, "uuid": "cf6396b4-044e-4a81-b37a-2fac3b0eeb8c", "value": "6144:QDxB10X25idYTsQapDp2dnzun7hs8ar2pM/RpvyxdmU2uAwCNl:MxBaXuidYTpaRp2dzq7CX2y/DvyrmUBG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773004266, "uuid": "683848ce-3db8-4d6d-9a37-27799573df35", "value": 224674, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773004266, "uuid": "e1b55138-5d9d-40ab-98e0-e031a65ff8d1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773004266, "uuid": "30943da8-789d-42b2-b187-b249edceb901", "value": "m-6.8-k.dick", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c6fccef-1b2a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773000283, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773000283, "uuid": "27f1fe83-b443-4ff2-b7ae-e0972c3ca3c1", "comment": "Malware payload (Mirai)", "value": "87d889882e065cd9736139e16d8747ee", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773000283, "uuid": "7e02a6d3-80ed-4cac-8fc6-95a9295f1a33", "comment": "Malware payload (Mirai)", "value": "013048d97473d50a1e5aeb4e452a9336c858eb21e5086a383c6a421bb00a7bbc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773000283, "uuid": "46303a55-fa0a-40e8-a5d7-cac7277e3891", "comment": "Malware payload (Mirai)", "value": "91e14111422f36726f30ee5339c973ddde369176", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773000283, "uuid": "623eb7bf-9deb-4b3a-82f1-25265b1cac36", "comment": "Malware payload (Mirai)", "value": "980d31bd7c2ede776bae0b6e95e44e4d2d8143b76b03ed95f80119f3c2aee42ce58a9155ca72e461ce08ddb07a243dee", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773000283, "uuid": "b74cfc37-494d-4518-bbe9-57df55e704cc", "value": "T12B43F791FD824A67C1D423BAB75EAA8D33B163E4D2DB7313C8204B607B8954F5D66F80", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773000283, "uuid": "45a0f900-eb73-4f42-8e0d-00321d090352", "value": "768:9h6orJljMmaKxtN3ujAQLt6FD+J55nS+htAzEENtjv6ysfqYAmo1Fwus:7JAmaAtg6FiJ55nRfAzZtjidqp6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773000283, "uuid": "7f9e7120-3153-4b13-a47c-ff4a7c545957", "value": 55880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773000283, "uuid": "485b1780-d92e-4d68-bfe6-534ac55d64cc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773000283, "uuid": "ff010256-dae7-4634-bb85-7e095a380f61", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec444757-1abc-11f1-a769-42010a9c0008", "comment": "Malware payload (DarkTortilla)", "timestamp": 1772953414, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953414, "uuid": "ec35ba8e-ea57-43d4-a40f-be0f451bdde6", "comment": "Malware payload (DarkTortilla)", "value": "5906aa141749598b45851583aaefa182", "object_relation": "md5", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953414, "uuid": "387c1a9b-a9ec-4096-ae41-7d62c03a4ee7", "comment": "Malware payload (DarkTortilla)", "value": "018f85786e3cbf158c1a9d44c0d82bdd8d86958e7f8eb9e8dc74e3293f42c068", "object_relation": "sha256", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953414, "uuid": "bcf211cb-5504-4f45-acca-432585d67130", "comment": "Malware payload (DarkTortilla)", "value": "b7cf8356908d2b810bc9fab4db66561fb9e0c5a9", "object_relation": "sha1", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953414, "uuid": "4c50cd25-5250-4ca0-a182-eea3cfffc52b", "comment": "Malware payload (DarkTortilla)", "value": "e87e554bb9cf6f5728b6dd8cae3a71bac5925111da451ceee0a052f41404dceff1b8f64239b3c697324658cc94da8a90", "object_relation": "sha3-384", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772953414, "uuid": "f8763a24-e8a7-4400-ac05-59b84505bc88", "value": "T11785F00163D85F68F47F57349875086197F2BC03EE22DFCDB2895DAA2D31B81899A723", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772953414, "uuid": "5b52e5b5-e701-4db9-8dc2-ac76adb9b47c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772953414, "uuid": "28cc69d4-e7ef-4abe-9550-8c320f4e99ab", "value": "24576:3ExD/kqGR8SlTxV0/eS9BrVXqI+6RO2XHyu:3Pvz9W/pVaInMs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772953414, "uuid": "cabd2943-38d8-466e-8b33-c40402b51f44", "value": 1865728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772953414, "uuid": "5b7fe418-c9ba-4c3e-add4-e575e154b609", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772953414, "uuid": "c02ec332-9f78-453a-bf9f-3b8a8207dd46", "value": "DHL INVOICE-04885.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6440ba9b-1abe-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1772954045, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772954045, "uuid": "254ec6ab-183c-4214-9842-c575b7137f35", "comment": "Malware payload (AgentTesla)", "value": "37964824b164c671cd5db246a12d4ae7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772954045, "uuid": "9953e45f-6c7d-4ef4-a67f-75d9afba68e4", "comment": "Malware payload (AgentTesla)", "value": "01d2762fc34ae359a9507fa40dcb092ab6a0baa3443011e0a945851bc32586a1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772954045, "uuid": "5de18b82-f8b0-494f-b9b5-8e424e9ed53f", "comment": "Malware payload (AgentTesla)", "value": "ec376cc6916f6a5200c3a0894b0eaf5daea57a01", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772954045, "uuid": "55b59550-4a69-4744-bc2e-f94af33497ab", "comment": "Malware payload (AgentTesla)", "value": "abae43f2ece4c2653b8cf6cec38aff9166e5c5e865196c7693c33d487bffc8d66d72c68bc17363ba398e0f09cff0a5f9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772954045, "uuid": "bf27d0e1-fa34-4357-9788-93a6bd2a9bdf", "value": "T14D559E4888943DDC6B1ECF0910B6874AA3F025DBECCDF486F626EE577596D034826BE4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772954045, "uuid": "3f3ec75e-9e93-48c8-a92a-d159ebcf62e8", "value": "24576:TQlFPdb95fKt6nqGPGiIDIziC5NC34X9Zh+4NtVPCrY0bIAUpgOq+PjBv6IRLQ05:Tipdbo1Dg2Wg4AUyynXbTP8pi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772954045, "uuid": "2f86852c-89a7-4bd5-8034-6d2379b14a57", "value": 1397428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772954045, "uuid": "82d0b077-ac45-4e78-b797-2ac4016bd7c7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772954045, "uuid": "222e4493-d601-4e0c-9fdf-a512462619f4", "value": "37964824b164c671cd5db246a12d4ae7.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e00b645-1b11-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772989709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772989709, "uuid": "4bc4a639-bbd4-4f23-b195-f8a165931109", "comment": "Malware payload (Mirai)", "value": "1c24831e0b374e0168cad94fe99af8a0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772989709, "uuid": "a853c385-c0bb-4b1c-9056-a2a8804ff996", "comment": "Malware payload (Mirai)", "value": "02141272e9a223c0ada39dc0aea12237a256ab51e77a88a4d2f2f9587eb3e625", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772989709, "uuid": "cda4be63-9a41-42be-b367-65a8d01045e4", "comment": "Malware payload (Mirai)", "value": "63751555857242141a4837018d49787146d338fa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772989709, "uuid": "08250e5b-9de1-4458-8c14-1882caeac7cc", "comment": "Malware payload (Mirai)", "value": "a9fe2909a073a63a82dc2a82e0ceabe9bb4b328bd1543ec67a6413bb01de9ca9203e3f798f197aa3f57d9223892e2ca3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772989709, "uuid": "5a3d37bc-585c-4222-bb91-23ef6124a431", "value": "T19FF53A62B892DE93C6C05675BB5DC2DC7B175B34D2EE3206CD0443283BBBA6B097B152", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772989709, "uuid": "e72ca78f-6991-4576-9ec8-485f073ba29e", "value": "49152:ZtXckDLVtNsPcrU1qLdZqyA5FuTg/r+fhWCQPA:ZNfptNsP70Zje/kWCV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772989709, "uuid": "d96fc753-4515-4076-b2a7-bd894c00ca2d", "value": 3545444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772989709, "uuid": "26ef66c1-e35b-4ea7-93e5-4842f08aef33", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772989709, "uuid": "4e69fcc7-6d5c-4da2-9ff4-0d1afd3bbe5a", "value": "armv7m-linux-musleabi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8eebbcba-1abd-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772953687, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953687, "uuid": "ca53ac08-9bc8-45a1-8cf6-21e76431b972", "comment": "Malware payload", "value": "d37e0ac3eccbdf867877e3ee5aabe677", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953687, "uuid": "b8af49e7-bc7e-43d4-9b79-f182bc43793e", "comment": "Malware payload", "value": "032477f1fb5791a9118cc8d14708f3f158d8c4b49fc3672279ddaaa0ff8b9ea3", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953687, "uuid": "ff87c77a-8ebe-4231-bf26-f07e3f4e0426", "comment": "Malware payload", "value": "30839c76c1e7a0feaec5522a547e39299e7cf2c3", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953687, "uuid": "42e341ba-9ea0-4aee-afe7-4babd94a7cbf", "comment": "Malware payload", "value": "3050a2a1ed41639da93bfd138130c04a65f566fae2a3b127cc1a6db57e0d7a6acb5eda8eb09c295cdd82271958012e16", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772953687, "uuid": "09aa9e19-b43e-4e0e-b2f1-798fa38d2dec", "value": "T1A2B2348C3ECA747A0276643B7D1FB11AE12F8C42F09C50A5C6527699FF64338D1BAE58", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772953687, "uuid": "06e3ae0f-5a5e-4811-abf8-b3cbd09f3ea2", "value": "384:vNxQ0yY+eY+a87GDSFWv59KERnpEzfTiMoUG9CSBT6DGhF6HE:1W0yY+eY+aSWB99xpuvoUG9Nwxk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772953687, "uuid": "9812f6f4-fbbf-424d-9831-feccfe7813c4", "value": 24334, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772953687, "uuid": "cb4d7abb-a0a2-4d57-95b3-9b8ffdf050f7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772953687, "uuid": "1a8177d0-31cc-4862-add9-5e910a95c9ab", "value": "d37e0ac3eccbdf867877e3ee5aabe677.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da4bc9f1-1b23-11f1-a769-42010a9c0008", "comment": "Malware payload (CoinMiner)", "timestamp": 1772997622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772997622, "uuid": "3bbc5ec0-f4dd-41a3-b754-c14a8ab6765a", "comment": "Malware payload (CoinMiner)", "value": "6ae48c13af23b2ac3e868be1ba600c69", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772997622, "uuid": "34eb2255-ba0e-490b-9658-74febc7b51a6", "comment": "Malware payload (CoinMiner)", "value": "037163afe180f9fd7f5806cfd4b2cc3c513563bcd0a270d297b9bbf09764a49a", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772997622, "uuid": "95d548db-92ac-4f4d-8625-d48e03d5ce91", "comment": "Malware payload (CoinMiner)", "value": "bf08ec3362b6136448b43ede2e81c8d9ba016a07", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772997622, "uuid": "ef72fbf3-d32e-4ebc-a050-6ce34f5dd80b", "comment": "Malware payload (CoinMiner)", "value": "019e8b1298b917a3320e1283b2932be23dcd107e1146ef87f6001ebc6f68629ba01f4bdb0d2e7a5a4a1f75f342a1284c", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772997622, "uuid": "b0e6fa30-619e-463d-8588-9bf41fead0e3", "value": "T1F4757C03F69989EAC49EC07883569132FA36B88D4B30B6EF17D41B743E66BA05F1D315", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772997622, "uuid": "67bb813f-f8d0-4f01-a420-64e9eb1341ba", "value": "eee6504681b54e7c1e64178e0cdeba18", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772997622, "uuid": "08bd3d5a-cba8-417c-8743-a77ff6a43b8a", "value": "24576:atordm4CDvqqWzNNmpu9IGd8pEarAsKFfv5:at2dm4CDviZNsu9J8+aUzB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772997622, "uuid": "7527f092-73ae-4882-bb2a-838cadbc71be", "value": 1647104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772997622, "uuid": "fd96d0ff-397c-4a0f-bef9-604b60b790e6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772997622, "uuid": "d829638b-d82c-4039-a7ac-36f63cee3170", "value": "isxodFn.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c47b0178-1b11-11f1-a769-42010a9c0008", "comment": "Malware payload (EternalRocks)", "timestamp": 1772989854, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772989854, "uuid": "4b23bc3b-124b-4510-bb90-5fb3da82d181", "comment": "Malware payload (EternalRocks)", "value": "1921ee83b5f39b95b9b8c8b464ebb7ba", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "EternalRocks", "colour": "#8EC11F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772989854, "uuid": "1df843ac-46a0-4c9c-87bf-79089c530961", "comment": "Malware payload (EternalRocks)", "value": "03b4722296d5e7163bd58e2dddf38159e4eec34ab2a4a05225e8cd0119e297db", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "EternalRocks", "colour": "#8EC11F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772989854, "uuid": "b8a94864-341a-4835-bd2c-df3fb4572eb9", "comment": "Malware payload (EternalRocks)", "value": "c81295c8a43a4631c8d086158dacf6dd686a88eb", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "EternalRocks", "colour": "#8EC11F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772989854, "uuid": "02226f1d-fd1a-4970-b02e-60434b9c9d75", "comment": "Malware payload (EternalRocks)", "value": "3b94be685d310ba8eecaac44c52a273224e7558c15a5a31ae9a0bf64f85882e03c381d6164f4bbb6e4283e1f9f05a0f1", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "EternalRocks", "colour": "#8EC11F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772989854, "uuid": "4da5514b-df37-4f44-9997-2586c4935268", "value": "T1AE058D9132EB6DBAFAC74B7BA129A52F0336542D3B51CACBC3207D4B54726D29C38543", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772989854, "uuid": "a6088db8-d910-443a-9d62-ff45fd199d91", "value": "000a4df4beffc7e55729dacb598b66f5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772989854, "uuid": "13e5d7ed-a8f8-41e9-9794-f24fa6272275", "value": "12288:MsuOAR4rxFukVC8NWaA4limOO7A1dGRVU4AxaSjZpNi7fc0lh5FnkG:MbO+IGkA8tBOObtQpafD3nk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772989854, "uuid": "c1ce3533-f449-4975-90e6-8feb5acb2f24", "value": 821760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772989854, "uuid": "3434c7e3-88b9-44ba-a69b-9be4f0836baf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772989854, "uuid": "89dd3791-4524-4045-8656-fa57c81f6e78", "value": "verification.google", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb9d5873-1afc-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1772980928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772980928, "uuid": "5afbef1e-2fb6-42cc-b60f-e2b7f53c0df6", "comment": "Malware payload (ConnectWise)", "value": "517fc7a86a2fb91f21a31d7fb690db03", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772980928, "uuid": "85810a8a-7135-403d-a169-d8937b029970", "comment": "Malware payload (ConnectWise)", "value": "03f6e5d70260c1dedcab1d5375eac458f0145a2859edb6cde63cacdd652539f9", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772980928, "uuid": "1e1e5bbc-17c2-4a3a-827a-95df10e70116", "comment": "Malware payload (ConnectWise)", "value": "322a85302de9eb829aafdbc8343cb68732b09645", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772980928, "uuid": "b63a079f-182a-4682-8947-489c542d4ec7", "comment": "Malware payload (ConnectWise)", "value": "ea3e04c6f92cef4030fd1014d9265a4d551080645f7494e758849c27248583bbae31db081a6fd9649e51a219277fa64e", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772980928, "uuid": "bcce6949-f21b-414d-99dd-e23910c90ba4", "value": "T141D6232523FD441AF8F74A79FE3682A45D72BE64CF21C11E9228B90D2A74D4096727B3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772980928, "uuid": "7e53cbc4-b8ea-4b3e-8dce-8de92024936d", "value": "196608:qWh0cGwpWh0cGIWh0cGjWh0cGwWh0cGSWh0cGpWh0cGX:qWacbWac1WaccWacDWacDWacKWac+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772980928, "uuid": "ffdd2dfd-09eb-463b-8f8b-ae1997c13878", "value": 13373440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772980928, "uuid": "453b6782-03b9-471b-bd93-ef427618b458", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772980928, "uuid": "b785edfe-8141-4f2a-8158-2b8ff097a6a6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "412d0efb-1b24-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1772997795, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772997795, "uuid": "4d798551-1448-4c51-8bdc-212353c7b306", "comment": "Malware payload (ACRStealer)", "value": "7786acef10a6deb70cca0fa0d5cbb3f7", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772997795, "uuid": "0bd3565e-0cb5-42d4-a440-3cd9205079ca", "comment": "Malware payload (ACRStealer)", "value": "053c866e69cc9f52407c8c8b449365d98765e66751c60b96f93452b2c87f4378", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772997795, "uuid": "2816e812-8664-45df-9d77-c697ff4719a3", "comment": "Malware payload (ACRStealer)", "value": "0b2effb636910c9ac343a20a08f6b23d957d2065", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772997795, "uuid": "665fc281-b505-40be-a094-7e2c2eccd681", "comment": "Malware payload (ACRStealer)", "value": "5e9c798e979cf0d37ff8c9228865c8847649893e5f7c40c3f399d8fe154e471a72dd14a9adb76dfc0eab144627bdf600", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772997795, "uuid": "a69db365-717d-49c2-b95c-d63caaba38ce", "value": "T14A066257DF01A106B1F4E87E63FC71219494ACB148B693348AF6398CD9BE6DC5C0AAC7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772997795, "uuid": "9af193ed-cd3d-4b75-97f6-87c8d4edd881", "value": "12288:javCkKsj7+G5QbTEOklG9SKylq+avCkKsj7+G5QbTEOklG9SKylqG:jF2+yKKGUKyJF2+yKKGUKyr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772997795, "uuid": "f088be72-bc94-4bc0-9097-8dc0640ad078", "value": 3868075, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772997795, "uuid": "7a1d6a30-fa42-463c-a2f5-bc65d68e235a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772997795, "uuid": "e423a9fc-9839-4ae7-aeff-6360d6786136", "value": "vocals.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "179b15cb-1b15-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772991282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772991282, "uuid": "21b9e39a-5719-4d64-b1e3-f50d8f698468", "comment": "Malware payload (Mirai)", "value": "93b8586ee41d4e7124072a98074e2ba8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772991282, "uuid": "c6b52380-1c99-4e6f-bab1-39276ad49cf2", "comment": "Malware payload (Mirai)", "value": "05a8956aad94f820f16bf78b5e320586b415147327bec05b8e7d143191476258", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772991282, "uuid": "7470b91d-8239-48ca-b587-4265d37b5dfa", "comment": "Malware payload (Mirai)", "value": "7d5bddde1c4785b4e84ea81c987110f8679f87a6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772991282, "uuid": "de26f516-4da7-461c-a4dc-ae9bedfa67f0", "comment": "Malware payload (Mirai)", "value": "e9a56d019a40d073fe91e10881b89871023d17ab941e51ed66aaad1b0c1990e0cdb0c0708b02a30ce6d5becb69f7611c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772991282, "uuid": "e5447f51-a371-4d21-9058-686713dfbfe0", "value": "T1CAB35BB3CC26AF98C655D074B0B18FB92F53A59482471FBE19B6C2B44443D8DFA05BB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772991282, "uuid": "c410f075-3c1e-4997-bd4f-43a42c49e074", "value": "1536:OTW/VCxsHZusQ2Li62C87mKjR5fvPVWARouW8j3W+gJH7t:OytCxsQx62NVjzVWxuWM3by5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772991282, "uuid": "11c4cb06-81b1-47f1-bd14-5fa915815d82", "value": 117568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772991282, "uuid": "4d455e3f-f3a7-4377-93f8-822733fe975a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772991282, "uuid": "cf878d2b-6bbe-49d6-9ea0-fdb6bd99ee2a", "value": "main_sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae57274f-1aa9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772945150, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772945150, "uuid": "6c491097-6d87-47b1-bf58-6ac56b3600b9", "comment": "Malware payload", "value": "da8b8b1892290691d0465c34a857eee8", "object_relation": "md5", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Vigorf.A", "colour": "#0808D7", "exportable": true, "hide_tag": false }, { "name": "Vigorf", "colour": "#1A2C84", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772945150, "uuid": "d2f97ebd-3dad-4992-a26d-f3cac49dc424", "comment": "Malware payload", "value": "06328e27d906ef067bd0cbb6822ae4f9dd0d6e13f4e209c948ad0b0919b0b9c8", "object_relation": "sha256", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Vigorf.A", "colour": "#0808D7", "exportable": true, "hide_tag": false }, { "name": "Vigorf", "colour": "#1A2C84", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772945150, "uuid": "69996bb9-6e19-4637-b940-9425e807720a", "comment": "Malware payload", "value": "7feb83613381cd98d170cd71e01b77a9fc617fc3", "object_relation": "sha1", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Vigorf.A", "colour": "#0808D7", "exportable": true, "hide_tag": false }, { "name": "Vigorf", "colour": "#1A2C84", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772945150, "uuid": "6059ad1a-b73e-4930-bade-ba6f38e2a0b2", "comment": "Malware payload", "value": "1dfb5f0c2c49c5ac392fca885bbef36805a06baad7a2057f0a94f6df01a2f57e5203080200c2ca0e5da5083225487b63", "object_relation": "sha3-384", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Vigorf.A", "colour": "#0808D7", "exportable": true, "hide_tag": false }, { "name": "Vigorf", "colour": "#1A2C84", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772945150, "uuid": "b91bd544-11b3-4691-ad27-8ef32cad3199", "value": "T135F23AA1C658ABC9B5CDCD1383D47C49016D70A3CE9425F12D394FAAE880F18AF3DE95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772945150, "uuid": "f547557f-7a3b-4707-97c2-d158d6f35d80", "value": "192:eNiO24M3nebE9KVBeWXWFY5pQcIoQy3j5i/0XtPTFa0yC090:C24MXQo9dTyz5IKtLF7MS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772945150, "uuid": "5d367e4a-23b1-4ca2-b870-5af4cdf13285", "value": 35596, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772945150, "uuid": "444a6424-c9a0-48e4-984a-7853cedee24a", "value": "application/pdf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772945150, "uuid": "404869ee-86bc-4858-904d-1652565f00e1", "value": "LHDN_2026 -3.pdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b009a98-1abe-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772953976, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953976, "uuid": "1f8e908f-dedf-4702-8934-00696c835fef", "comment": "Malware payload", "value": "4bad60be9078d151baef09e49a9b7bd1", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953976, "uuid": "67d960b2-e1b2-47ae-a387-44d6ee1886be", "comment": "Malware payload", "value": "07016f40c0f0d853efcebb79889a61b16bd2c319f75a24d195fcdf84c2646184", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953976, "uuid": "b79c2e40-c6d4-4a8c-8acd-e421bcd9d783", "comment": "Malware payload", "value": "a6f8604c6d966e7e467153b956ca1c6f184c7f81", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953976, "uuid": "cf7e5b0c-edb8-40c9-8558-f3fc278e3841", "comment": "Malware payload", "value": "ebb197c81f400cba71dd960303df3ab8c84ec93a387af54f461ac2d82844ef139fdc2733532d7dbcbd857c10fa2e321a", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772953976, "uuid": "f5def92a-51ed-45a6-8123-c82ae4e3a829", "value": "T1DDC4D9ED2EC2F59D0F429933F21AF06EF4F488F0636A4C2AA1DC1C48E8516D5EE55639", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772953976, "uuid": "a06fdc7f-5c31-446a-84bd-0940db5571b6", "value": "6144:uY2CsWVuvscQJwlRCO2qrsxjVKZKIlwmBxt64/5TvG973:uBuuvscWyZrshiK6jtxhvg73", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772953976, "uuid": "f326ce55-6768-4810-9881-03616a833737", "value": 565955, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772953976, "uuid": "e3213f11-b9bb-49b0-bf1e-e1266f616e4f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772953976, "uuid": "b9ee372a-defc-44da-b43a-f59494001e7c", "value": "4bad60be9078d151baef09e49a9b7bd1.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da75ba48-1b35-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773005353, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773005353, "uuid": "2b2dd6e2-9877-4cb7-a887-4e4a62f2d14a", "comment": "Malware payload (Mirai)", "value": "e13b6c2f008207fbaad32a8698e74f04", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773005353, "uuid": "8788ff21-a0c5-47e3-81b0-5075f20b9b23", "comment": "Malware payload (Mirai)", "value": "0741b8149cb40e02e10466e2299007b263f86c4293b85d895241571eb37d3f8b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773005353, "uuid": "c58dc084-acd4-4d6d-9e57-ad1211599fdc", "comment": "Malware payload (Mirai)", "value": "c0d2654be5b979c43ae5ac179659f8448e92fe73", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773005353, "uuid": "51c5da2a-bac9-4172-9ef3-c2a1d69ce3a8", "comment": "Malware payload (Mirai)", "value": "fe87bb61bd2890503d9ba6c6296c8a384c1d67839f5ed8395cbccdedb43b0d7f3641433aa6560c9fe26e08d06fb6e2a6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773005353, "uuid": "15b226c3-2480-4e22-a19f-bc61ccb92b1f", "value": "T16FC3E70ABF110FFBD86FCD3706AD0B0625CC554A22A57B3A3674C928F54B65B1AE3C64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773005353, "uuid": "a806791d-0b1d-406f-8407-5e4d62f2e8da", "value": "1536:tvX/WZT5e6n/+Q9pK4asQBfHcETfRDQpZaRBqrZpHpwWLBNvk78PJ:tvPWZT5e6Zpk8EupD1g78P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773005353, "uuid": "f2b7f7dc-7e1d-46e3-a281-5661fe8e326e", "value": 122272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773005353, "uuid": "5ffa4750-a2fb-4491-b30d-a7b9fca0146f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773005353, "uuid": "29b72d39-d3f3-4174-a977-b4fecf011490", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce92f5b4-1b46-11f1-a769-42010a9c0008", "comment": "Malware payload (RustyStealer)", "timestamp": 1773012635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773012635, "uuid": "3f16df7d-cc18-4698-b508-b3bbf7fa50b1", "comment": "Malware payload (RustyStealer)", "value": "d2f52cd3127eaaa7bb98a8a9d8860001", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773012635, "uuid": "c35ef532-fd4e-4334-bb30-9652fc6b0ac8", "comment": "Malware payload (RustyStealer)", "value": "08bde694b34a73d4694288a6a67a7e0d9628066589215c17291bb4d21dc9dfb3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773012635, "uuid": "cbc3143c-734c-4863-b012-2e7a1af74850", "comment": "Malware payload (RustyStealer)", "value": "64d5d2228f8b91547ea6cccff835ec012ba37f4d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773012635, "uuid": "d772d55b-d920-4850-a32e-8e47cc80ea67", "comment": "Malware payload (RustyStealer)", "value": "e51e97a6699682c6f0a8c1121bc1f5ff9086bca19862bafa23bdc854568bd4da1dd32465ffb534a97bd786c0e82c73d5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773012635, "uuid": "a987f1f0-ce38-4033-b07b-ac1a4726d6e7", "value": "T1B8F53363FE90A572C9EF61F1040CF3E8CD7685318750CADBA7F51D20E895AF21276A62", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773012635, "uuid": "36937de3-38e7-4da6-9ee3-ff401b0bfdf8", "value": "8efb0dc5e3712d2bd3cf552fada17a3a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773012635, "uuid": "422c539a-c402-4345-9024-422da9865562", "value": "49152:LDdMXHQ4OTj7qACzoh2ytVBwLASAU+xZtArCIjDpuo0foJC8RvCsm/nh:fdYHLOn7qACzoFrSt+JA+I/so0Qa/h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773012635, "uuid": "19538788-68e9-4dd2-8bf4-4f1a6b7c0524", "value": 3487424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773012635, "uuid": "966095bb-5ab7-40a8-ad25-937e85bde2d8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773012635, "uuid": "649e6828-bc5c-4062-a86e-b4a9692beaee", "value": "SecuriteInfo.com.FileRepMalware.71412363", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2076bc6c-1abe-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1772953931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953931, "uuid": "85765c2a-39ee-412c-9326-de0f7ba94f99", "comment": "Malware payload (AsyncRAT)", "value": "e924ad583b4038d07c767666d3aeb5bf", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953931, "uuid": "6e721770-4732-4098-9f42-e490b97e6243", "comment": "Malware payload (AsyncRAT)", "value": "08e138cc388cffdb30e15d498e6b4a3c0b8e53fd15b15371dd6be85be49ba3fa", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953931, "uuid": "e385c8ee-a575-49e9-b285-e61636c391ad", "comment": "Malware payload (AsyncRAT)", "value": "5d9bcbaec866b55907f256afc762df68d30609a3", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953931, "uuid": "0d1c9c5c-c759-476e-8e28-118009f8eed4", "comment": "Malware payload (AsyncRAT)", "value": "978a063b25b4fdacdc02b50064da3cd86d517e97d9e615f1fbeda7119b1a73767681e8765723475dd29c5c5eb8d18ef7", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772953931, "uuid": "d84fc113-9545-433d-968e-8302c8a6af61", "value": "T13DF515973CD870D0525318569EF0A9B2EDD5E89046EE0F68AB4DACE3D89E44C790F378", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772953931, "uuid": "1a3da561-4cbb-471c-ba47-363133195509", "value": "384:O+XmSa4hI0laFMgrk1MXJeMdvn7rIXbes1KdvSxz3mdvRefz1WBpfE12BA3dvaHd:4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772953931, "uuid": "e04d1f10-4d58-4266-b33b-816c6aca46fc", "value": 3491866, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772953931, "uuid": "6e72130c-9d08-40d8-8cce-79489f68194c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772953931, "uuid": "dda49652-1f86-4838-830a-21186ef23762", "value": "WMIEventLogs.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "402c50f9-1abe-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1772953984, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953984, "uuid": "78b9454e-ad19-4eb5-9d73-4f791d50a370", "comment": "Malware payload (RemcosRAT)", "value": "ad468c45522cddd5c412a6a65269b388", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953984, "uuid": "55c8f97e-d778-40a4-8002-1d761561e09b", "comment": "Malware payload (RemcosRAT)", "value": "08f4e43fac6f13d0e30b38273d7e2885a76cc5024b91dc2a1bb9ca971d47786e", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953984, "uuid": "618e920d-c553-4e2e-a6d1-97fb7557faf4", "comment": "Malware payload (RemcosRAT)", "value": "68b13bb96b300bd4f30f44cbed938901f8200164", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953984, "uuid": "504a856a-178d-4a83-964a-78f8c7ec7e99", "comment": "Malware payload (RemcosRAT)", "value": "9f2f18c5931b3c43658dcf7efba8d6c0d8d802da0487bacc90ff9ca9868439183e45d2f99de7c3c796eb04e349c0d564", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772953984, "uuid": "d9758385-c6c2-4c0f-a125-85dbd9218826", "value": "T150E21EC336526728BABAB43CA946C4546FFD3F430F90D86756919DD9BFA048B891B00F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772953984, "uuid": "ab38c7f5-3ad5-4622-af0f-3c9f8f69eb7c", "value": "768:jeaZDG7G+xeOJOL5My0XPqtSi5/P3N7a1:8UnG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772953984, "uuid": "07caa774-00a5-4282-97c1-5f43b092b1e4", "value": 34087, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772953984, "uuid": "e93d6f91-85d8-4fa8-93a4-2b46df0b5c85", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772953984, "uuid": "db95060b-b3ff-4662-b4a4-c5298ba9961e", "value": "ad468c45522cddd5c412a6a65269b388.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee2ec9a2-1ac6-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1772957712, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772957712, "uuid": "846086d7-4d0f-44f5-9456-16da5210ca88", "comment": "Malware payload (ValleyRAT)", "value": "0a437cfc4736d2285ba95abf683ea298", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772957712, "uuid": "a59798b4-ffe3-4262-b567-8c2a163699dd", "comment": "Malware payload (ValleyRAT)", "value": "0a6bdad5dc4add4b571d11608f30eca32acf96da82688f8839f13efd64e76a8f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772957712, "uuid": "05537503-8a6b-43f0-a50d-54940b14003f", "comment": "Malware payload (ValleyRAT)", "value": "7f8a49580c6daeadc2a2dca89222b4153e729208", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772957712, "uuid": "043c5c8f-2acd-4ce2-bd1a-e1f440f07253", "comment": "Malware payload (ValleyRAT)", "value": "22715a52d8ed52ce844ebc800829c428113e74e9ddc41f3c8ad5bdd95f61c1c9d069312b98db1f28d3ed93a844f6934d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772957712, "uuid": "bcb0d4a8-4c45-44c4-af7b-ce52893d4184", "value": "T1B9B62202B5F1F6B8C159C17057158BB2A2317CCEAA317FBB1AE1B6342D71A218F18B75", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772957712, "uuid": "4192fac4-198b-4730-934c-b724f7bab905", "value": "18282fc1904d19b61884a0fe03ef73a4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772957712, "uuid": "fe9a4cc5-7bcf-4883-b3f7-c7a17eb5f92a", "value": "196608:pntb7xiBZCPtVNsA21XdoBumANHYLHyR0eE4iDBdXeVTu+E1:pnd7xjPtVqd+umSF0T4iXe9O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772957712, "uuid": "67180a32-ff71-4532-99f9-9645b9dacb2b", "value": 10747392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772957712, "uuid": "ee5daba1-6a6f-4cbb-90ee-7924ed98f637", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772957712, "uuid": "63e93bd1-1578-4908-a153-768a7ef9b95e", "value": "0a437cfc4736d2285ba95abf683ea298.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c06f3ade-1b17-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1772992425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772992425, "uuid": "6489885e-4164-418d-86ce-b681d92b6af3", "comment": "Malware payload (ACRStealer)", "value": "c9b6218cab2284ecaaa8bfdd0fe71e7c", "object_relation": "md5", "Tag": [ { "name": "46-149-76-78", "colour": "#C728F9", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772992425, "uuid": "238d1fbb-85d9-4c27-a2d0-289dfc501279", "comment": "Malware payload (ACRStealer)", "value": "0b5fdad7754d2354340ce2d01248572cc4c122a0a87fd474f68f24efc975659f", "object_relation": "sha256", "Tag": [ { "name": "46-149-76-78", "colour": "#C728F9", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772992425, "uuid": "9cbb0385-b922-46b9-8201-3ae2f94cdee4", "comment": "Malware payload (ACRStealer)", "value": "e5bfbb75c40f14b3d25047de8f3f84cf32052630", "object_relation": "sha1", "Tag": [ { "name": "46-149-76-78", "colour": "#C728F9", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772992425, "uuid": "e52bb7c3-52de-40dd-80e6-b4aa12db462a", "comment": "Malware payload (ACRStealer)", "value": "af6ea89b73b471aaec0916d687710dac4b323be94f25e57d4b5513dd717da7d91dc57ef4f5057c7a95b075d60ec51c4c", "object_relation": "sha3-384", "Tag": [ { "name": "46-149-76-78", "colour": "#C728F9", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772992425, "uuid": "21301a31-3cb2-402e-9a8a-b0cfd307987d", "value": "T171D633A9D626E74CDE32FF3AA49F810E8E1BA57E0831E0077E5D99C56C41DCE270624D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772992425, "uuid": "77bf25d1-970c-4900-830c-a69a6c914cab", "value": "393216:bHqtlbAlV6bB/w1XgbNi3DqGQbTMrjphQURTEqAhuwnnb+kk:jQbAXOasNiWGgM37QURhAkmnPk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772992425, "uuid": "ab2ee1a6-fcf4-4632-a82a-d40eb762201d", "value": 13735634, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772992425, "uuid": "8503ce4a-09cd-418a-8cd5-8949b2d82c97", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772992425, "uuid": "9930ed8b-daf4-4fd5-851e-59c7b63f4dc6", "value": "SETUP.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0a19e0a-1ae2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772969689, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772969689, "uuid": "c16dd755-c783-4858-8ca4-024729a5da7e", "comment": "Malware payload", "value": "74e7f5af5f1c148a59ea8aba6423a20d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772969689, "uuid": "f74b5722-4c37-4917-995a-01dab57a667e", "comment": "Malware payload", "value": "0b98f3b8281e7234a3243ea7cf85340ba20107bd103574547e97a8623eddbd04", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772969689, "uuid": "ac8583ca-4efe-42d9-98d8-d518a73d369f", "comment": "Malware payload", "value": "ed3bacdddcc6ff6744dc18bfa1d6116d57b31801", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772969689, "uuid": "c542efbb-3020-481f-b16f-2e13de4b1f55", "comment": "Malware payload", "value": "c4169d88293c9e0d2beb220755fdcf36283f0c1a7b581ccb2c1104368458eead5d4a847eee307b88334a1b5165d919c4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772969689, "uuid": "3fd04954-3da6-4ea1-bc7c-a4ca16295bd7", "value": "T1ECD7333377C19473F09547B4C94EC2A64C6CF69E2AF7530B9E30DA9E18BA3818579263", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772969689, "uuid": "5b227145-0c0c-419e-92b8-a81507f414b0", "value": "20dd26497880c05caed9305b3c8b9109", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772969689, "uuid": "2aab70c8-7aac-42fb-a0c9-0fd980a8f73a", "value": "1572864:88Jjc2zLEBcqAbWeXaN9EtMTOX0/9pY5JMS:ZvEBcFW7/2MTOM05yS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772969689, "uuid": "54483f4e-d520-4191-a5bd-4a283a40803c", "value": 61786192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772969689, "uuid": "ffda33a9-22a4-483f-a05a-5aeb425eb6f1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772969689, "uuid": "e646627f-6608-4b95-814c-047e04009864", "value": "Minaro.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "582d8564-1b2a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773000410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773000410, "uuid": "8254aec7-0a23-4359-8a01-c5edbb77a0c4", "comment": "Malware payload (Mirai)", "value": "8c4ca223b3bba64dfa423a60efbf11d9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773000410, "uuid": "907e177c-c0ac-48e0-9a2b-9847a30edbd4", "comment": "Malware payload (Mirai)", "value": "0da9a1833bebca5fb2a7d3374fd470ea7e1735b3d415777880bbdd0e9c1ef943", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773000410, "uuid": "2fb76c6e-e72e-462d-95ae-43402a120419", "comment": "Malware payload (Mirai)", "value": "11bcc5456afbbb490e3acaf123218cf4ede8bc74", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773000410, "uuid": "ede7a65d-a783-4dd5-bde1-474fb43c64e7", "comment": "Malware payload (Mirai)", "value": "a8696c77c1160c6ca575f960d9085c67216ea441f7c2234c1ae922825f1ff057f1c1f09937fa8dac944958da0d390ef7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773000410, "uuid": "f0061b58-248e-4466-8643-837e306f1869", "value": "T15183ADBBE42A5E20D24589B078B5CF711F63A5C082532FBA26E587786087D9CF905FF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773000410, "uuid": "d7c3628a-5f63-4891-bdab-966993377c4e", "value": "1536:sawoNhLhkfaHuoRMc3wdiULd4KEmzh7lwbJxCOUVt+76kV:sCp6faOAh3wd3Ld/E4ybJxOV0+kV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773000410, "uuid": "6b9f1669-73fb-45f7-8f59-334323406cdf", "value": 83532, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773000410, "uuid": "6361eaa4-009e-4f6f-b622-1401d2fc2094", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773000410, "uuid": "9b141ef2-a726-4722-8151-27bc5e4ff5a1", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fdf9bb2-1b3a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773007349, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773007349, "uuid": "ce16e70a-8cb0-4c00-a7da-f721779820c4", "comment": "Malware payload (Mirai)", "value": "1d7217d593a55d5966aef292c1b66e07", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773007349, "uuid": "95f24325-6123-488c-9da5-78865c5dd9cc", "comment": "Malware payload (Mirai)", "value": "0e4bf8be4a390438e0582a3659a5348da41d2c92ea29ede35190a06c30bd0bac", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773007349, "uuid": "fb907f8c-e1ad-45f2-a970-5ee750db8069", "comment": "Malware payload (Mirai)", "value": "ea6aab8e46aaf81529eccb2a5c1c01d34af8bbc9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773007349, "uuid": "47f479f4-3dea-4c88-b0bd-fa34b5460feb", "comment": "Malware payload (Mirai)", "value": "3c4223fb53c615424cb866d0fc79ddf455d06fe7cc3a1d72cd9078622a5d6b8e3320ca2a3e838a74edba15dae1631cd4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773007349, "uuid": "624d7575-7fb6-455b-be43-5dc33470b72e", "value": "T1ABA339C1BA43D4F5EC1641306177F73B9A32F0B91239DA87E7A49E327C92A419D0A39D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773007349, "uuid": "54e40b66-7d2d-47d2-ac30-69ccf13c6392", "value": "3072:PbKW4dCLFaGFBu3/45g1rcV2w4zSr9bMFflne:Pbj4doYGFB0/45gdQ9ulne", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773007349, "uuid": "d81f8eec-ce10-470a-ac60-7f111b724f54", "value": 106887, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773007349, "uuid": "af55c799-18df-4aad-a5c4-38960f125080", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773007349, "uuid": "1a6cae55-26eb-4a7c-a866-004a222a17e7", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b978adfe-1b30-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773003150, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773003150, "uuid": "3d4cb3dc-c2b1-4b99-8513-d1ac05b0860a", "comment": "Malware payload", "value": "0b76e9f3d34bbf4c57fb8b395728f89a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773003150, "uuid": "8b8e4e63-2356-4718-b7f8-c2c41b553b38", "comment": "Malware payload", "value": "0eaf2891550402414f250e88c644fd957b2dd3d88afff394654fbd24650583a1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773003150, "uuid": "5631a6b8-8a0b-4cb4-b8fb-fb311ba3e300", "comment": "Malware payload", "value": "4a570fa4f5f431303e3cad5db85c4e9d57056f3a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773003150, "uuid": "16d2e912-862d-494d-9a7b-91c60606ef4b", "comment": "Malware payload", "value": "060c882002b0a2274ba7a053ed8f0ad881b73f80d29b90e4add65098e9d12b2ab1e7de23a3fda415e54358d063ff9646", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773003150, "uuid": "6469466f-5e52-44a0-8fc6-785127165364", "value": "T18C05B042F1A881E8D86B953A8A53B917DB3238185F3016DB33D46C546FF33D1A7BA712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773003150, "uuid": "049306d3-a11b-4f2c-8805-7bd0df68a5ab", "value": "4153b5c0239d361b53f2d8b5c59cb5d6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773003150, "uuid": "5e43b939-bac5-4b3a-981a-e444fdc13b37", "value": "12288:RMa1itfyMFvKloYVw+5nkmPiVCYd80UBEx4CSiJnsSWFDVbXjE8egRM0BQGw:RgmoWw+VkmqVCyAPiJns3FDVbg8XxQG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773003150, "uuid": "9c982eeb-3a01-442f-89e8-02b21bbcdf6e", "value": 861696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773003150, "uuid": "67abb82c-be10-4b46-911b-f1bd105817fb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773003150, "uuid": "d5a5fd62-ea92-44e1-bb9f-06dbe9c28ed1", "value": "SecuriteInfo.com.W64.ABApplication.FKQB-3736.5973.27911", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4df36036-1abd-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1772953578, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953578, "uuid": "206be708-0c55-41af-b88d-58931335b63e", "comment": "Malware payload (XWorm)", "value": "525cdf7d8b6820f87dd5ee71bf0f9808", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953578, "uuid": "1cb03453-a3e7-4f3a-9486-0d0c0cbe6300", "comment": "Malware payload (XWorm)", "value": "11f836e941d85d391284e34e4c81be06d0138422304119a96599044babe6eb6d", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953578, "uuid": "c94851d4-f271-459a-ad90-9fead892d13a", "comment": "Malware payload (XWorm)", "value": "b4a1c0c91accbe5f836a8581caa1a5b30f54e3a4", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953578, "uuid": "e377fa9f-ee46-4ca1-9abf-39118d379cf2", "comment": "Malware payload (XWorm)", "value": "b3dd816143c7d026c37557c1dd4ea2df0ee75339d9da078cf15f2a06d5e306e862cd915d95f6ad6f9bd65f237bf68df9", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772953578, "uuid": "f79835bd-2365-4afc-803c-dbcb15b02e2f", "value": "T11855772643002A5D7793E898A9E6758C4B5AF9C5BE824EFB302CD4227ED1B23534FD71", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772953578, "uuid": "5b771ee0-eb79-47cb-b86d-21782ae01e44", "value": "48:DjPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPN:DuP3ff+IUEgn37p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772953578, "uuid": "90a4e6e9-1209-4863-a7a1-ae1e96bc50c2", "value": 1296904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772953578, "uuid": "881a40eb-7be6-4d7d-8cca-9ed94471a25b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772953578, "uuid": "67251c7d-053d-411b-8bb9-0d8efe1860f6", "value": "525cdf7d8b6820f87dd5ee71bf0f9808.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40b2005e-1b2e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773002089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773002089, "uuid": "afcf9626-21e0-47b4-bd2b-d9819815e38e", "comment": "Malware payload (Mirai)", "value": "4cd264707105ec30d8035af86e334356", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773002089, "uuid": "dde76887-4b96-4a77-9430-1d89f78f063c", "comment": "Malware payload (Mirai)", "value": "12a5878fd54c0ab4f87564ec4682118a240fe924e1f65e0196dd76558d86392d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773002089, "uuid": "97a9c212-022d-4587-9f1d-1065a9c34b0d", "comment": "Malware payload (Mirai)", "value": "13055d41fa48e76839b1ffb761a3dbced462e789", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773002089, "uuid": "eddb27e3-c3bc-41e4-a79b-214c724bbf08", "comment": "Malware payload (Mirai)", "value": "3fd12adaf1b1f999ca995889ce9f73a07b0b77d4ab25e9cea37c6a45e1966039494cf9347dd3fbeaa04e33850aa77d46", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773002089, "uuid": "ecdb27df-4332-4d6d-b74e-c70c4a93c49d", "value": "T164A30859F8819B12C5C105BAFF0E518D3313176CE3EE33169E248B75378AA6B0F7A616", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773002089, "uuid": "69aa34bc-67ff-4cbe-8bc9-bad4e05769e8", "value": "1536:vhndj/4Vk4B/wzfqCY4dVN/aevj4AMviK3p8DN7EM7xOU5efJzWe7C:UVkNziCXVN/ae23pyN7hkUeW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773002089, "uuid": "5924eefc-d0fd-49df-8fd1-546333909a78", "value": 103740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773002089, "uuid": "77d27ee7-29c5-4258-9eee-868b9e4558f2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773002089, "uuid": "28db034b-aabc-4eca-b7df-bdcb40e9e7ab", "value": "violetarm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41ac6f95-1b05-11f1-a769-42010a9c0008", "comment": "Malware payload (QuasarRAT)", "timestamp": 1772984481, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772984481, "uuid": "4c8264c0-80c8-49da-9d33-0ae22251f0d4", "comment": "Malware payload (QuasarRAT)", "value": "5d7acabc50075281b979141afcab8436", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GenKryptik", "colour": "#DBB467", "exportable": true, "hide_tag": false }, { "name": "Kepavll", "colour": "#0EEA41", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Kepavll!rfn", "colour": "#301EB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772984481, "uuid": "ddcc30f0-bb17-4394-ae2d-798e9ca86bb9", "comment": "Malware payload (QuasarRAT)", "value": "134acf0767d80de2bd6051c7d65b63f8260b75b6cac2885d63c3cb1f4b63eb32", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GenKryptik", "colour": "#DBB467", "exportable": true, "hide_tag": false }, { "name": "Kepavll", "colour": "#0EEA41", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Kepavll!rfn", "colour": "#301EB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772984481, "uuid": "f3a6264b-33f8-49c3-8b47-cdc3fc68ce7f", "comment": "Malware payload (QuasarRAT)", "value": "79cd1c4379f17f9704c07b68f0192196f3144316", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GenKryptik", "colour": "#DBB467", "exportable": true, "hide_tag": false }, { "name": "Kepavll", "colour": "#0EEA41", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Kepavll!rfn", "colour": "#301EB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772984481, "uuid": "d4fc12c0-cf49-4d5d-aa10-e4f2fc2c0905", "comment": "Malware payload (QuasarRAT)", "value": "56a8b6ec66482f8c045805aad1ecadb9dd5e579d1cc954d9996cbe397e6d6cd338ff615489c39de10dfae724f7ecf079", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GenKryptik", "colour": "#DBB467", "exportable": true, "hide_tag": false }, { "name": "Kepavll", "colour": "#0EEA41", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Kepavll!rfn", "colour": "#301EB6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772984481, "uuid": "752b8df0-1a72-416b-8d3b-70079ea6ba9d", "value": "T12CE7333FD69748ADC6D7C278AB019B6192A23C580630FA9703D561633767D308EDFAE4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772984481, "uuid": "a6bf65d4-1b44-485a-8ec6-1932fc6ce9bd", "value": "58d79376b72d770f4e3c72628dce32d3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772984481, "uuid": "760af6c3-41e2-4e6a-af8c-519818ff5d9f", "value": "1572864:Q4dZMpcQvrKaemstxdJTbFP568ix5Aln7nbmNjK2896vcz1gfmV:Q4dy5vromoxHb385un7bmN2246f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772984481, "uuid": "93cabd1a-3e0f-4456-94ff-8a3990684feb", "value": 67728216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772984481, "uuid": "b290c0d4-9570-4adb-9cfe-74255c5810a4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772984481, "uuid": "e55fb111-6f54-4e5c-9f7d-b9899624b804", "value": "EYY_otover_win64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e971b565-1abd-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772953839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953839, "uuid": "0de1cbf7-a6c6-4c97-ba67-056d4ee40a82", "comment": "Malware payload", "value": "f581c5d020ab2387313e42c9326e15ba", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953839, "uuid": "7fb74831-7c0d-4205-8bb3-6b28712e75c4", "comment": "Malware payload", "value": "18919b938962ae76ddbf4b754858bea503cb5a487c20a9984dd0d7d759ea3cfc", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953839, "uuid": "e6817b5d-4662-4077-8310-065ba1466244", "comment": "Malware payload", "value": "eaec16144416e49a3ff037ca9f1f9b9a1309e991", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953839, "uuid": "653e08d5-8066-4c48-aa98-893b2971be6a", "comment": "Malware payload", "value": "a0fd67a957b781b73faf1bba49693fa9bf6637b8e9bf4921f627dea5d85e4368860474812fc06f50c69a2de02b66454a", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772953839, "uuid": "e6302c90-d2dc-4194-9b9a-933c8168a9ed", "value": "T172C4DBDC2EC1F1AE4F82A933F20AF06EE4F488F053565C29A4EC6C48EC516D5ED65279", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772953839, "uuid": "bd46bc99-2718-454b-8a42-1f2787327bcf", "value": "6144:nzeL0FTOBAat9yt76yAICUZ7fJZr3D0Y1:nzeL0FTOuatE73AXWTJZr3YU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772953839, "uuid": "7830566f-c473-4c53-831f-ddee7fc42ec0", "value": 558421, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772953839, "uuid": "ceea89b9-56ce-4275-9564-66833d4638d3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772953839, "uuid": "a6f1995d-65cf-47e1-a08f-bcf29b1483f1", "value": "f581c5d020ab2387313e42c9326e15ba.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "186dc709-1b21-11f1-a769-42010a9c0008", "comment": "Malware payload (CoinMiner)", "timestamp": 1772996438, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772996438, "uuid": "0a544323-4500-4c99-a18b-d0ce40885bbe", "comment": "Malware payload (CoinMiner)", "value": "03321ba90bef15d389151a53fec8109f", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772996438, "uuid": "9a3ee498-799f-4d4b-9336-5dd75a99d23f", "comment": "Malware payload (CoinMiner)", "value": "18a6ab8bab49ab74041d2a61fcebf9a8e0576dde28ff04420f6a9b1bdaeccd58", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772996438, "uuid": "257ac7ae-3cd2-4bae-a143-7d1ba064e9bd", "comment": "Malware payload (CoinMiner)", "value": "072443001d8a41dc3882ac1847b0741050796380", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772996438, "uuid": "1fc46013-723f-452f-b7e7-fa84d8a0285e", "comment": "Malware payload (CoinMiner)", "value": "065cef506532921962ee36b6c8cb3ee4fe51853a7532d229c037babe8596439659520c1616fccd1e67c3b8e4a95b5e0f", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772996438, "uuid": "8f02b4d2-f2d8-4a82-8543-ff7e4f3f8df4", "value": "T18C4218076D964131FBE40CB1197A424B86BD3DA23BC1E89FB740F94A2DB2760C47563E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772996438, "uuid": "f0049c2c-8040-4dc5-ad92-756b810c6323", "value": "059ef2ae60d092146585018c0d07841e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772996438, "uuid": "431e5121-edd1-451c-a579-b309cdee134d", "value": "192:PNATKlXO8PYYleg7zvy7tXpyMJxTZ3lkWScthBsufT:Fi4XYY0AYVZKWScBPT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772996438, "uuid": "4a07ccca-a35c-47fa-b1d0-f2e60bf0cc75", "value": 12288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772996438, "uuid": "2e13b4d0-45e9-47d5-bc1a-5e07b948354e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772996438, "uuid": "9df91ec3-c13a-4354-adae-92b840eac495", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f152e326-1b29-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773000238, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773000238, "uuid": "ca5310b7-55dd-49e7-8c2b-4b4bbe34c63f", "comment": "Malware payload (Mirai)", "value": "5f25b08f5e36102da89e86fa0afe0edb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773000238, "uuid": "553b9a7c-9e3d-4dbb-bcba-ff0674efc712", "comment": "Malware payload (Mirai)", "value": "18fade5024c462a2c1a8729db744407a0c6ae80bcba02f34a0b474bbc2cb8ab8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773000238, "uuid": "2866c1ed-83ee-4904-a9a4-223e78bcafea", "comment": "Malware payload (Mirai)", "value": "8922db5337f1fa9dfb43b8758720f0ea1cfcb58d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773000238, "uuid": "34c5542a-8676-4978-9d71-8a582bf56a8b", "comment": "Malware payload (Mirai)", "value": "52a0b935e6c9b9e6311639f9391f73c10e175285ac44bf656f307d2a56987286a67d6fe7775bf93907f85e0af91a0457", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773000238, "uuid": "c5e5d9da-4abf-4a8c-ba3f-cf18ad4fbed7", "value": "T10B140981B9117F73C1C3ABB6F7DFC2453B72661497EB3301AA59AEB02F4668D0E29141", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773000238, "uuid": "152ca316-ac4e-488c-ab14-7eefe252a233", "value": "6144:5IBTIv4J6eTcVslFDeEUm20NaY0ZZt/t+VRPd0q+:5Imv4Jp4VMFum20NalZr/t+VRPd0q+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773000238, "uuid": "9ccdaf0d-ad27-4c52-9434-1bc7a7b53d3d", "value": 204280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773000238, "uuid": "3fe57e89-de08-4c82-9df6-e816fda7e6fa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773000238, "uuid": "0ce81523-b2b7-4916-a004-af734a952c84", "value": "a-r.m-5.dick", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b39a21d-1abf-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772954325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772954325, "uuid": "be7131b5-71fc-46b8-9649-1c8f0c6f60c3", "comment": "Malware payload (Mirai)", "value": "f97255bf0c03405a9e16c448748b0ff5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772954325, "uuid": "2678b661-65d3-4ec9-80c1-eafccdc37306", "comment": "Malware payload (Mirai)", "value": "19c0cebbd206bfc40bf8eb9cee193fb126430960cf4cb06f7dc3ce29e74a8145", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772954325, "uuid": "10a6a96e-87e2-4097-8653-d64e9f736122", "comment": "Malware payload (Mirai)", "value": "943bc5352d8a80404baf5d68d747996acaa10f19", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772954325, "uuid": "5985e5e5-0c30-4d26-ad55-92963ca38e34", "comment": "Malware payload (Mirai)", "value": "b645da721161ffde3ffddaa0b6f034965389b1db47a34793ae24f6f802e6e17fef75b6d97ceff35608ca27f7d419cbb5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772954325, "uuid": "9c7639ee-789a-45ae-8ad1-ed525fc47ea0", "value": "T140E35D8AF4029E7DFD4FE5BE44670D09E931A39131830B2A53DBFDA3A9311A94D17E81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772954325, "uuid": "6a1d32d7-adab-4bb8-a1a1-81fc37cd46df", "value": "3072:7oDlIyA+oy+ZGiTP/lZoEhH5lgLOoe97dlJ8jf4:1Dy+ZGJEFxoe918jf4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772954325, "uuid": "7fffa012-75d2-423c-9737-e85533bf2e58", "value": 147336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772954325, "uuid": "a5d49c53-a035-425d-80a8-60853408ded5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772954325, "uuid": "45e59946-550f-4d3e-a70b-bf8061115c2c", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf6a20e5-1b3f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773009603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773009603, "uuid": "f67a9e1f-430c-407f-8b86-12345d376a8e", "comment": "Malware payload", "value": "a248c79a7ba90986ede45e90d10b9225", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773009603, "uuid": "c794938d-74d8-47bc-8171-a8539a3c8063", "comment": "Malware payload", "value": "1a2406ad754fe974e3e3e147846957d4cd55cdd2e761fc27db561c7ee0b0ac90", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773009603, "uuid": "1d32392d-bbca-44ee-be7f-bb64faa5d234", "comment": "Malware payload", "value": "c8b84b2125c2ef52b497c8d1fc6794f2f658bb8e", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773009603, "uuid": "09ebd02c-47dc-4c26-a88d-a0671616fb98", "comment": "Malware payload", "value": "c35096233145c65096646d9ac758e2d71d1e9dcd2bee48df8b8c83bda44f325e8a884cd62a789d3074f4d7907709f5f3", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773009603, "uuid": "2af4ec31-0ea1-4e42-b664-6611fa9935be", "value": "T19C573398D8364E9FF07FC4315D746A1E45B23C61BB63D537324837989AB3BA072BA409", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773009603, "uuid": "9b706a88-8224-4543-af39-6011a2b2690d", "value": "786432:XC3vK0w0AQx2BvQtZ2H+FF0O4Ztahn4kp39eM:XC3vK0jAQQBot6+FGO4smktU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773009603, "uuid": "111c90da-bbdc-4878-87ce-0f93a43b60bb", "value": 29569024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773009603, "uuid": "fdd15740-a1ea-44e6-a274-b64fa561f5b4", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773009603, "uuid": "7910bd28-1444-47b9-86ca-5576902d1b9d", "value": "CrimsonLoader.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f21985a1-1b28-11f1-a769-42010a9c0008", "comment": "Malware payload (MaskGramStealer)", "timestamp": 1772999809, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772999809, "uuid": "eb143241-30d8-409f-a0fc-ada55002469f", "comment": "Malware payload (MaskGramStealer)", "value": "97cc0e9e85e99688f866bb5d9ec3a86e", "object_relation": "md5", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772999809, "uuid": "9d9d8898-508f-414b-af48-36f821dbf386", "comment": "Malware payload (MaskGramStealer)", "value": "1b168cec247028a7a7b31976bda554e0e59697756a7f1265b49e395da0b30949", "object_relation": "sha256", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772999809, "uuid": "8b806542-4bb3-483f-ac10-1bab7055d100", "comment": "Malware payload (MaskGramStealer)", "value": "6307be023442c847ca9e7c87c3400a491a87eb6e", "object_relation": "sha1", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772999809, "uuid": "1f94c9d2-ca1b-4e21-9fbc-0a8df36912fc", "comment": "Malware payload (MaskGramStealer)", "value": "c6e57b96792c8f2602b1a2e7fb2a4dad91bf37470094e419a47328129a957427b2ada308846e5e5e434b51db6f1c06a7", "object_relation": "sha3-384", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772999809, "uuid": "331d9fbf-7a01-436e-a428-c61092d9592a", "value": "T16DE73358F97C0C7BB9273506E7F8D1C680F6D0985B5B853BA71851F1A0A7BA08936C3E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772999809, "uuid": "2ad49b30-7072-4fbd-9e1e-75a79b9c5d0f", "value": "1572864:GuE+uMyi9xJi7wU9P4/30Ur7EOvBPP4z3JcWU1S1:bE+uMfUY0Ur7EOvezuWUw1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772999809, "uuid": "089f85d1-aca6-4c1c-a7b5-7c361817204a", "value": 69202742, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772999809, "uuid": "0710dd26-8a07-4560-b8d6-e7512831b770", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772999809, "uuid": "3250c111-2b50-4f77-8945-e320aa4d972b", "value": "Xeno.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ccd2b2f-1b24-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772997922, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772997922, "uuid": "2bc5203d-3966-4460-bde9-061e64bcbd2b", "comment": "Malware payload (Mirai)", "value": "08996ec4cfc838f416896c3a3d15747f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772997922, "uuid": "00636169-aa65-4343-a812-93e6578b233e", "comment": "Malware payload (Mirai)", "value": "1bb935b82759b360be241e1fbd0083889b8d1716bba650f4c786a98f4b6e50c0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772997922, "uuid": "92d4e86a-89c4-46bb-b252-59062fc896e5", "comment": "Malware payload (Mirai)", "value": "db176508e6840ad5d4b9b061d6bc955194e52686", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772997922, "uuid": "29a1cd66-6204-48a3-9ce8-7130defb8f82", "comment": "Malware payload (Mirai)", "value": "43d98b16b57ad36d738c2b0ff3a4d89df84a680b55a1f732be2bccc865a6a052018ce1fdd06bd25cb964b69bac084f0d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772997922, "uuid": "692767ba-b60d-4eec-9b9b-90adfcc6e0e6", "value": "T1EA833B07F58280FCC48AC1751B6FBA36E832B1FE1238B15B77D0EB126D49E612E1DA55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772997922, "uuid": "0c595e4e-3ca7-4092-aacb-2cf4de362cf1", "value": "1536:tPx9wWTcpwan0FCsd9xJ3ZwzTRIUICrB3KCy71jS08PJsIseQdqMNWey3:+WQpPnQZX3ZwzT/13KN1jS0MsIJQ9NW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772997922, "uuid": "7250b8b3-156f-4449-9d43-ac4c34f65d69", "value": 87072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772997922, "uuid": "3445cf6c-7739-4413-be32-1c3e461bf333", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772997922, "uuid": "203974fd-90e7-4629-965f-a306aad85e64", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4af1b87c-1abe-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1772954002, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772954002, "uuid": "5078fbdc-0b08-48b2-a1b5-24abafb81393", "comment": "Malware payload (Formbook)", "value": "d7ac142c0f2cbcb3b466fb811e19f97b", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772954002, "uuid": "dab70aa7-6382-418a-9584-2e53432f7af7", "comment": "Malware payload (Formbook)", "value": "1bc5f2d3c8d9ff144f16a61e4019689ebd77097ca6ac91f86ad1184275d301d6", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772954002, "uuid": "9cc9b428-a23e-4cc6-a5c0-19533772d8a3", "comment": "Malware payload (Formbook)", "value": "9fc036acb0fccc60320060864f779ffb154216e1", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772954002, "uuid": "69c31aad-0de9-48cb-afaf-a513931f40b2", "comment": "Malware payload (Formbook)", "value": "e297f3b10cf423f61d33d02bdd8eb2243601670bd72eccefbb5dfd3022585db3906a6636f230267ebf5423acfd6636ad", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772954002, "uuid": "a530f099-6056-4b8b-9756-968cc46d99fb", "value": "T13BE20DE715E907EA860BC7B2F40AC58AC4864DFAD3085D58717B42FDA3B477B88D2472", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772954002, "uuid": "ea6042fb-efac-42ce-929c-fa4232642da7", "value": "192:KWhgJHSeSZqU5OXuBwjSuikXJ6UvhBc34APBP9lRDFTwOZrJfUP7:KtShw4flkRe4AJRDhwOhJsT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772954002, "uuid": "7d59e8e5-29b6-4746-a96b-1e7420177120", "value": 33913, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772954002, "uuid": "b3ee6e25-9ff6-48ae-bab2-9409e49db97f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772954002, "uuid": "e7cf9713-b804-4bcb-b929-d44a97c8928a", "value": "d7ac142c0f2cbcb3b466fb811e19f97b.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46160232-1abd-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1772953565, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953565, "uuid": "7036a455-efbf-4b1e-b15b-2690425170d6", "comment": "Malware payload (Formbook)", "value": "f524576426589e18347028230b3aa6b9", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953565, "uuid": "ef52c703-7dfd-43fb-ac1d-3547476a196b", "comment": "Malware payload (Formbook)", "value": "1bf4da9fe2cdc30b7e9edd59f62337ea575840216c85ae0b5e59ea7ce5abb145", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953565, "uuid": "ccca6c37-89ff-4297-a0ea-ad27e6b61be3", "comment": "Malware payload (Formbook)", "value": "3c4439391c038acabba17c437722accf79290e6e", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953565, "uuid": "56282b5c-a076-4dfe-ac51-cc4f97066699", "comment": "Malware payload (Formbook)", "value": "b01df9ce05fc00165fb358205fc0f1e7cff7aac5a4e3811ddd1670dfbeb3fa58024b5191f228da9de81b75da141fb38e", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772953565, "uuid": "73347626-c6c0-4984-9dd1-02a518633f6a", "value": "T19E82851A8E069FF0053E7152B66B6816B9204366F538395D3C4FC4AD3F7AA14CBE11EE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772953565, "uuid": "39dd64c9-6b50-4c85-a5e7-7c824cf0842e", "value": "384:KddsEfezFlbFKyb5Wh1ochvJpu2B9gEp7P10YM4FnM4zEMf:Kfpm0O5CndppN4Mf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772953565, "uuid": "77912759-d979-44e7-977c-23a86e056809", "value": 17581, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772953565, "uuid": "8a1c1617-fecd-4bdb-baca-f13bc1bcf115", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772953565, "uuid": "4b1aa0c3-bce7-4b7f-b223-a6c1343e4866", "value": "f524576426589e18347028230b3aa6b9.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c1636d5-1b3e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773009087, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773009087, "uuid": "993b9b94-234b-4b03-a906-3bf163a0d4d1", "comment": "Malware payload", "value": "ba90d0b41689c81ad2071f8d1530c4eb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773009087, "uuid": "116bcfe8-e869-496f-ac18-684267f97735", "comment": "Malware payload", "value": "1e81a8bbfd70426367039e57fa9c82130c05bd5139866c40f0f33ed68d84f907", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773009087, "uuid": "7d7aa208-677a-42e3-a940-3687b5e882e0", "comment": "Malware payload", "value": "0d60f7ee46aaebacb108a7b4ddff6ed5ec6686cc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773009087, "uuid": "2dc8a35f-9b14-461f-abbf-6dd1d8778bdb", "comment": "Malware payload", "value": "e9b493774ac183f07f0c251cb50ac02219527081295bc6051f1cb812fafd7e643d2bbf4a566947ee839fda146782bf1c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773009087, "uuid": "0bbb0758-0741-465f-a1ac-2916565190de", "value": "T18DA56C07AC9549F6D46AA33188B67292BB74B8080B3273D32F50A67C3FB67E05D39754", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773009087, "uuid": "5074dc9b-1b95-46e5-9a7d-a4072fd9220d", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773009087, "uuid": "5b27e14f-660f-410f-9373-cf97d22f3bce", "value": "24576:1ZkgsvcHXh+CXZYPsCQNDy//XiUPew0SjRCrjrpeXtCMtZ+12DeleNK84HTwB/lF:1Z+voXkCXWPsVO+tzkVydzm/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773009087, "uuid": "982f232c-e427-41cc-a92f-4fe29a4fd76e", "value": 2195456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773009087, "uuid": "b720937e-37cf-48c4-b867-94d1610e58f2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773009087, "uuid": "4c11be61-fab8-4d89-b8ea-6a5e47bd4227", "value": "mamuel.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb2f5b6b-1b29-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773000227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773000227, "uuid": "a7e2686c-b4b6-44de-a576-d8553b449d66", "comment": "Malware payload (Mirai)", "value": "97c721ad027930a310b3d39615918d1e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773000227, "uuid": "4dc22bc4-2c0e-4de6-b2ec-8a4e49fe22b2", "comment": "Malware payload (Mirai)", "value": "1e8e770435030ada3f5765113dd6f5c8a129f35b169ef228213242822ac04b7d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773000227, "uuid": "eea38073-a7ef-4088-943d-92fe4d9a8677", "comment": "Malware payload (Mirai)", "value": "8cd6160fd4c3f8cd4d2ded6c2cdac6e5c7a4e591", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773000227, "uuid": "3aead3ba-b619-4bc8-a736-91aa91a1f815", "comment": "Malware payload (Mirai)", "value": "cea4a594a8a41405707a6b47176133427da1be99374d76d7faf0c5d7abda80be4b43a52f365cccc90f2f73efa8ac51ae", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773000227, "uuid": "eb820892-b0ef-42ff-a6be-835216d1f12f", "value": "T144D30846BD418F13C5C322F7FB9E428C3B257BA9D2EB7102A9257FA037864DB0936651", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773000227, "uuid": "993be743-5573-4ab6-ac34-eacc70d11e2e", "value": "3072:WVQqG9tMSnTxuV3G4ZMJV30CPbLMTwhYobPm:WV4/FnlwG4ZEV30CLMTwhYobPm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773000227, "uuid": "ebd917f9-2ca9-423a-b474-47ae3e2a77e9", "value": 142708, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773000227, "uuid": "7b93ebad-bde0-42fd-8832-d9809f5bc55f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773000227, "uuid": "6fadc9eb-9eac-447a-ab67-b2664c89963c", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a783d5f-1abf-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772954324, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772954324, "uuid": "8e769ac0-73b8-41a9-a9c0-d1b6b5993eb3", "comment": "Malware payload (Mirai)", "value": "a06f2d8af4c103aa29baecce9a0e7663", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772954324, "uuid": "f4cc55b2-5152-46f5-98e9-f6fc70282cd7", "comment": "Malware payload (Mirai)", "value": "201c85fc60e8d8bd887ff85c8e5fee55ec7536b058c0459e5cb8f4bbee9468a9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772954324, "uuid": "64fc98f9-0525-4ca6-94d3-e2bd37227df5", "comment": "Malware payload (Mirai)", "value": "dac2ca16263ba8070bf4bc6c1128752768f38d4e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772954324, "uuid": "0dc9b4b8-5f1f-4653-bbdd-66e39b59c716", "comment": "Malware payload (Mirai)", "value": "e22070beb728ea8f32d289e8a5d2ee411a924a4cc5afb0eb5a056879c0a667000281ac3e5c34917b8157fe46c9e87ecc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772954324, "uuid": "ee6fcafb-4113-4500-9906-681425f7ea5e", "value": "T1F9344B45FA418A13C4D217BAF9AF414A3332A795D3DB730699286FB43B837AF0D67601", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772954324, "uuid": "9cd97fd0-bb8b-4963-a7c4-0e2583d1a415", "value": "6144:8KbtT30y9azauKacEK1dAnJd7LTfdfM/9hVdAU:8Qx0EazauKacE62JVB0/HJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772954324, "uuid": "d5569235-d61f-46f5-9626-10a5e94b2a63", "value": 231680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772954324, "uuid": "d2cf1cbd-5439-4a23-9588-30705ff40a17", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772954324, "uuid": "2453746e-bf73-4e6d-9df8-bf5309b70c9e", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13775ce2-1b22-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772996859, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772996859, "uuid": "e37b32a4-7a6b-4173-b42f-e5269d046e08", "comment": "Malware payload", "value": "24eab16bac00cc74d26fa084a799c043", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772996859, "uuid": "324ab665-46b3-48eb-a4e8-5ad4ef1e67af", "comment": "Malware payload", "value": "20c5421c8b618d0f3aefbb12f67e1d024663029526e6a20c71a29abba3ca86bf", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772996859, "uuid": "08d49efb-545a-4bfc-961f-1f8c6466c702", "comment": "Malware payload", "value": "a1b0ccc0adff387f3a980444c2d979096b26f358", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772996859, "uuid": "aff68e43-7048-43a1-9753-6e473d7b2248", "comment": "Malware payload", "value": "a01e041f887aa27940072f782b8ca73c8d178a9ad9ad876a94374c2f1226d35e3338002b480fb1ef7560188b04d4144c", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772996859, "uuid": "a8b8f6d9-2434-41e7-aae3-c3e06bd1f8f4", "value": "T192925DB512896C79FBD0CE39AF3C7F4DADE8C2C42124A3ACBA4F39215A1166DC705359", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772996859, "uuid": "ec2dfeb7-3e11-4c31-9dff-da30b53a8775", "value": "384:xlFcuQpWx+BL0SWL0gpzsO9a4cbddrME8jyfzsO9a4cbddrME8jy4:bF8i+BL0SI0SzsP4cbddr7zsP4cbddrk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772996859, "uuid": "58e49674-8af7-4f48-9caf-687f23fe0f27", "value": 19499, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772996859, "uuid": "afeb9341-0622-497d-9ec9-01853ca6310e", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772996859, "uuid": "9d01b8aa-ef50-448d-97ec-a4c487e4301a", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3bafa968-1b18-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772992631, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772992631, "uuid": "e8e61b44-6790-4562-82de-63efbef2299b", "comment": "Malware payload", "value": "34371ec2c433e445c670fdf87f2fcf1a", "object_relation": "md5", "Tag": [ { "name": "37-221-66-22", "colour": "#9E1FE4", "exportable": true, "hide_tag": false }, { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772992631, "uuid": "a73358f7-7376-406e-99a4-0e9de03936f4", "comment": "Malware payload", "value": "21b350c38e21290f38d961c5b65d661dfc045befb6a39868eaa99afa184a2d71", "object_relation": "sha256", "Tag": [ { "name": "37-221-66-22", "colour": "#9E1FE4", "exportable": true, "hide_tag": false }, { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772992631, "uuid": "3ce0b18b-62df-4579-9e4f-75d2e29ddde9", "comment": "Malware payload", "value": "ebb262c4c215b5f55a0f6a4abd2db45fbcdda139", "object_relation": "sha1", "Tag": [ { "name": "37-221-66-22", "colour": "#9E1FE4", "exportable": true, "hide_tag": false }, { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772992631, "uuid": "5c584fa8-0df3-488f-b8c9-5978aa0020d1", "comment": "Malware payload", "value": "545bb6b68e59037e7f1deeeabfc2aa6874c246bf1475d6fd8ab9cae476d0a42ee18f277a5cc1e1aa328904953f6f3e1b", "object_relation": "sha3-384", "Tag": [ { "name": "37-221-66-22", "colour": "#9E1FE4", "exportable": true, "hide_tag": false }, { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772992631, "uuid": "522d6f28-d4f9-4c24-8d33-83ba2867c06d", "value": "T154C523AEBD6070A0F18D2EB8A395856081A37D7DD9094E483741F7C5BFF2A9448CE91F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772992631, "uuid": "da674f7d-5789-4062-8768-28672b9ea154", "value": "49152:f7aBjMuvJ12ZuWAuRnRqmNkkwf8XiNxZD+CAmrcT924tbrpWH5H:fGEzAoMVIXihD+CVrc5tblWH5H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772992631, "uuid": "5024e070-3694-462e-a688-4409ce2606cf", "value": 2597259, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772992631, "uuid": "8b0e3ced-3321-499e-b410-83d81f44fbb7", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772992631, "uuid": "dc9e5156-55dc-498e-9452-2677bd28ec7c", "value": "SETUP.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8544180a-1abb-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772952812, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772952812, "uuid": "bfd81eb6-a684-44f1-b4c0-b04627301d19", "comment": "Malware payload", "value": "407e9432ce33434cf4dc9974f0778eb9", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772952812, "uuid": "fd08cb85-d2e4-4d1b-9646-aa994f9e070e", "comment": "Malware payload", "value": "23b809eb15e8f63d8773c294be9e6769d30e3a2ceb7113894356a3ace0bd15c4", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772952812, "uuid": "03f93c91-3893-4549-8b15-1a28700cc4d1", "comment": "Malware payload", "value": "7b6ba8168b1bb15afc03ef3d46a53f96b2a1d132", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772952812, "uuid": "283ba181-510d-4beb-9301-5ddb576d6af4", "comment": "Malware payload", "value": "fca244cc0203e0fa0b005535f29e0fd04f8ee31ce02245454bd425db8518b10c05c3f1b01c8f6e18345b22b92aa5302c", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772952812, "uuid": "99270658-1442-46af-bc55-18dc2f549d77", "value": "T1432612114B5C1E7A14289752A09E246961F98A9C4C26BDF971DDBCB003FB72E2047EFF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772952812, "uuid": "3b985eda-8e57-42af-aff0-71a989952209", "value": "49152:tKNuucIGHud1B829n1e9+JRIiFx3jQ3Alt+D58wbwEKYuPt4BQ7/pYB9XvA:8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772952812, "uuid": "c34ab84f-a9e9-406e-a71e-805da9bbebaa", "value": 4682663, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772952812, "uuid": "aab325eb-fb7d-43fb-b604-f82c0faeb963", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772952812, "uuid": "1b498d3c-bf21-4e2b-b2e1-861a7bed55a8", "value": "WindowsUpdateHelper.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e71dc4c-1abe-11f1-a769-42010a9c0008", "comment": "Malware payload (STRRAT)", "timestamp": 1772954035, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772954035, "uuid": "7b7730ee-0512-41c3-8a27-d60cc5165db9", "comment": "Malware payload (STRRAT)", "value": "a3194e87f76db110b03fcf6ae3f3414b", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772954035, "uuid": "54bde2f8-aabf-4dce-8af0-b030e8e00be4", "comment": "Malware payload (STRRAT)", "value": "23f8c950f99be93386fa6bde4ac6ebb1e61d090847676cd5cc45cd4664ebaf72", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772954035, "uuid": "142ed0cd-7500-4fed-9020-2c377c4a5b71", "comment": "Malware payload (STRRAT)", "value": "a7debade63c88539dfb98b3d008d9266ebb46e52", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772954035, "uuid": "c7afb25b-76b9-407c-af3f-0c8488400a8e", "comment": "Malware payload (STRRAT)", "value": "089dcf402d3831eeccbda9015098026630c3513ce361db6ed4bf9c0e021a6422fcbb21ddea6d661d7195b9daf7e36d9d", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772954035, "uuid": "757f9c3a-7faa-4a22-995b-e403a741b351", "value": "T1680422397CC69D5F6879C48864C8CF0A8920A1810429FC7B9D6DF8ED292FF57131DA3A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772954035, "uuid": "80da2c69-667e-4102-b815-ef6cf49ae378", "value": "3072:OJEYSBnEJIw8rweHClMbCq+Hstx5jP0ORVb4n6Vu1VwZSwsxsjivTUGUQf/YRoOd:TEOaeHgMuq+8jRRB4ncu1VwSs2fUs98F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772954035, "uuid": "bfca9e8a-ee57-4e88-a59d-87a527dcaa74", "value": 189917, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772954035, "uuid": "eb4dffa6-e483-4d4d-ad91-843085d05725", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772954035, "uuid": "c66f83b3-0212-424b-a707-6d05700da3c6", "value": "a3194e87f76db110b03fcf6ae3f3414b.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9991474-1abc-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772953436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953436, "uuid": "ace4bff3-9b3b-4ea8-a849-23fef9878a02", "comment": "Malware payload", "value": "47eef9752fdcd2d37400262d9d68642a", "object_relation": "md5", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953436, "uuid": "bb9500fe-78d4-4ef5-b709-7ac9733111aa", "comment": "Malware payload", "value": "25896f946207c4c09960ef6ecaf81e82545290de938915fbac76121389c31f43", "object_relation": "sha256", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953436, "uuid": "dbc08750-f742-4851-9f0f-415579ff4958", "comment": "Malware payload", "value": "867b84c5d90d445da24dcaaad9456e7cb9697eb4", "object_relation": "sha1", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953436, "uuid": "e872a00f-f16b-491c-8911-16ddbedfe89a", "comment": "Malware payload", "value": "3a7a7d3a2276e608ae157e7456ad0100aa62930dc72a38478b638a97d774b13e36feba99f7f25a78460590459573b0a9", "object_relation": "sha3-384", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772953436, "uuid": "4e01a4fe-8b72-45cf-ba8c-69b7ec2aefb7", "value": "T1CCD2329C2EEFA268134E30332C6BB496F26DDC8CB55DC864E3E25CD9F85C3089579958", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772953436, "uuid": "e001bd41-0245-4d5e-92fe-b2e233ebc1df", "value": "768:k5AtHMiL2YxQ4avzodHk0PjOajZmw3A/lFni00J5BWmJ:bHMiL2h479790/lFni0yBP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772953436, "uuid": "2ab770dd-3aac-4e05-96d0-3e78aae13074", "value": 30952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772953436, "uuid": "900a9a87-5974-4dab-b4fd-4115a7ab7dd9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772953436, "uuid": "c3fe384d-9a37-4502-8ea6-987fb751049b", "value": "47eef9752fdcd2d37400262d9d68642a.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "855aa590-1b2f-11f1-a769-42010a9c0008", "comment": "Malware payload (RustyStealer)", "timestamp": 1773002633, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773002633, "uuid": "1ad57e95-d822-48f6-a587-1b4698c2c646", "comment": "Malware payload (RustyStealer)", "value": "0a83ae0d2f0004850488c20ec4a14aa1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773002633, "uuid": "3c75fe88-465d-4224-915e-0b76dfe0326c", "comment": "Malware payload (RustyStealer)", "value": "2788e0a5aa953234b427955d133786bc99dd0a8e45439d541e7cdf87738e28ed", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773002633, "uuid": "a22716c8-3628-4f78-8bcb-800336991ad0", "comment": "Malware payload (RustyStealer)", "value": "e59fd14a995fcf91da5490e97e2fd3636bc10f7e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773002633, "uuid": "f7b02e38-0d75-4311-aeaf-7884a6a24157", "comment": "Malware payload (RustyStealer)", "value": "76170246c64cb21ca00f9636cb44da3291438eb66dd15a123a07e440260068b4397b5a8e349ea214109aeedadde60449", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773002633, "uuid": "03a46524-678c-423b-bd7d-eea6c35084ef", "value": "T163F6281010D96603FD3EEFBD85DCB6444F7AB2997722EA389B410DE90FD1B18C9429A7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773002633, "uuid": "1795c685-4b0b-43fd-aed8-78e708331cd6", "value": "196608:Y0c1T0KuE2JQ9LLGQcMQOh9RtYkfVOmlqbKVMRmyIYAXfXBsBgqwKng4u:YxP4QZLsMQOLlq7R55OfXKgrag", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773002633, "uuid": "7abbbc38-353f-46b6-9540-82cbea312695", "value": 15973888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773002633, "uuid": "1387ed81-ee84-4b4b-8417-b8b170facfcb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773002633, "uuid": "7d70c8ca-2b2e-47f1-8bf9-0ee7db165d64", "value": "clean42131.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8114df3e-1b30-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773003056, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773003056, "uuid": "15e523c8-a981-44ef-9cde-603e3733ae17", "comment": "Malware payload (Mirai)", "value": "9f778b5092ae3abb145d3286cb85467d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773003056, "uuid": "539ba7a3-d692-4821-b21d-adc4deeb48b8", "comment": "Malware payload (Mirai)", "value": "27a6164bbb038c0ef9030f900b484276effc1b888ac5d8b68f49e92ef9a76700", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773003056, "uuid": "aae43f82-de80-49b4-a197-6e112cb7de34", "comment": "Malware payload (Mirai)", "value": "3fa14fbb3ff28437dcc69aad282f2be13790e2ac", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773003056, "uuid": "db4839e7-f392-4c02-a16f-0d7b594aca0f", "comment": "Malware payload (Mirai)", "value": "a1e082da3951caa3b443778fca005f0073f38199f7d494c915e6ded5237a38ce33cc43bc44e9a6bba887a130714b98bf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773003056, "uuid": "c0a234e2-5dde-470a-8b55-c2a470e340e1", "value": "T159D3AD9BF38B04A1C86206F007CB4F9E2D6361C25F5BC5E37D29A63B6E754DB0906B91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773003056, "uuid": "8face9bf-878c-4dc3-be2e-af06f507011e", "value": "1536:s5II0zLazyR2vbTZiuBLdcBe4AFlj39LxgRx6Uugn5K+/LWO:rvy24vbTZiWL2BetnLxgUgns+q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773003056, "uuid": "4eceacc8-a06a-4e0c-974f-35048323becd", "value": 132648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773003056, "uuid": "b1a2317a-ae72-4d9c-b7d5-1260df79fb6e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773003056, "uuid": "d2f7ef5a-6efd-47a0-97cd-d40da3280ae2", "value": "arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "765b30c2-1b11-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772989723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772989723, "uuid": "bc7ae474-c3bf-43f6-8168-ac15919f24aa", "comment": "Malware payload (Mirai)", "value": "e5f4f4e1294cbe3ba2a048a49bb867ed", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772989723, "uuid": "969a8f50-6d71-4218-8d68-2c191e6bac7c", "comment": "Malware payload (Mirai)", "value": "28bda2ac90bcaec5847188500162c8cc3fece742577337787fb7c6d74251b92e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772989723, "uuid": "75e93139-da6d-4822-8c53-6f1f438c80ea", "comment": "Malware payload (Mirai)", "value": "a15f414f97c3c048b9078810181e03e3d513700e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772989723, "uuid": "2e27d5e3-1e3e-4aaf-b9d1-3237ab2050f5", "comment": "Malware payload (Mirai)", "value": "06a5d62b41fe8716e9e881ffb01e943808ae062b0279f3dca4d5087b1edfeaa99d04bdff1eba2220b046f659da490ba2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772989723, "uuid": "23985f2a-3980-444c-8f2c-2e0ceb2927f5", "value": "T138F55A917A68EC23C0581D37AE7FC7593B638E50CE96E150D7C0CA8DBE8B190DE251B6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772989723, "uuid": "89cf4b67-1409-4ad6-be3c-fc4bc9da5309", "value": "49152:Ped/hzyNb/+pAuvhkg+ynbbRtgGC15cxQP4wk:mLzByEbRtxCTcxVwk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772989723, "uuid": "ee2529b6-4579-469f-bee4-fdbf85af5436", "value": 3553640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772989723, "uuid": "19e4e3cf-6f39-4710-9ebd-522d6f3a5a50", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772989723, "uuid": "c5561f3b-b7c4-4c65-aa86-c4b968ff0633", "value": "armeb-linux-musleabihf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d99e62aa-1b2c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773001486, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773001486, "uuid": "478fb39e-3525-4e5e-90a2-cd05d507f8ac", "comment": "Malware payload (Mirai)", "value": "16e1e9c3dc7797578d1acb0cf26280f7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773001486, "uuid": "ce385cec-7cd4-43a1-a34e-0a5bc41e0ff3", "comment": "Malware payload (Mirai)", "value": "28f18e1550cfd358029e8f24d26696ef6a5e91773f8b19c80009fd957903af82", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773001486, "uuid": "8ec3f5dd-cf57-4fa5-9bb4-20b33b20e88b", "comment": "Malware payload (Mirai)", "value": "65480721d44e6ce3f056e83fc6e4a1d01de3258d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773001486, "uuid": "6eb762d6-f793-4cb2-83e2-1de09ebd733e", "comment": "Malware payload (Mirai)", "value": "888c9c4b57f92ba9967751b1dac3f75422c16bee26f75907cfac9245be826781594251af9b8f253ed5131d603a2277f1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773001486, "uuid": "552e4595-02a1-4d68-a290-ff87ba47f088", "value": "T141B47C98FE0E3C42E2C7F27DEE494BE2712732F4E32790B26992424DD5D9ED9C2A1511", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773001486, "uuid": "b70e4882-56c1-47ca-afe1-76fbd8b660c4", "value": "12288:51uI+T0jtDM7sMtkEZUApV3BzuYyyiT6bgDnjy1/8Uw5dWMV:uD0jts1ZRpV3ByYyBm1GCy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773001486, "uuid": "f0e04784-8d87-47c0-891f-05cd72de7d79", "value": 518086, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773001486, "uuid": "53ac443e-0e05-4b9f-9f36-50427d0531d0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773001486, "uuid": "84556bda-56d8-467f-9335-e31cb8374c51", "value": "data.aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5ebfeaf-1abc-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1772953403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953403, "uuid": "87f90600-e666-466b-8bef-431313994f71", "comment": "Malware payload (AgentTesla)", "value": "e4316f406f2b5416bfd7514de28f07a1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953403, "uuid": "5e86f1f3-83aa-44d4-9590-e316accb344e", "comment": "Malware payload (AgentTesla)", "value": "29012bdfe23bf096f59696e9aede0e0d709ff8e4d9afb55a919b64f369e1b36c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953403, "uuid": "e8a34733-f9a4-4294-b617-fc08d0930b68", "comment": "Malware payload (AgentTesla)", "value": "f15bbabde3e4d693a4d8ebbb84166b02e1a5e0da", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953403, "uuid": "e8590677-5a4d-4abe-8397-a2e746604834", "comment": "Malware payload (AgentTesla)", "value": "646ec0ec16c1284e54c391289b09b8ffbffb9208e7c641a0ce3a626c0ed8cc22f9444c2139ee22cc1510a11f4be15770", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772953403, "uuid": "35fde29c-3cfc-4af7-9e8b-43341ca67dd5", "value": "T113556D4161804F8E711D358AA1AF669E63F00D6BBDB152BC2EF67841ECEEDEC42046D7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772953403, "uuid": "65e8f656-cf40-4f19-908d-8dcd84ff127a", "value": "24576:mcmeraVwpGO1gC6Wg5lrKnvgaic4Tn6pko8:/+wpGODeIAFo8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772953403, "uuid": "c6caedc7-4850-496d-91b8-6a2abbb600fa", "value": 1394396, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772953403, "uuid": "2e201819-ef5b-479d-bbee-4a1abced31d7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772953403, "uuid": "eb88bc42-87d4-447c-827f-95f95d8038b9", "value": "e4316f406f2b5416bfd7514de28f07a1.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16d00238-1b15-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772991281, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772991281, "uuid": "53a74a34-f420-4560-9071-0d82659ca6bc", "comment": "Malware payload (Mirai)", "value": "4f2914a161da6250992f2ec2fbfd663b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772991281, "uuid": "55eed16f-7ae5-4008-838d-cdc04b7a0250", "comment": "Malware payload (Mirai)", "value": "291939293140aa08609a751808396e67984f8e954ebf3779eed667eacb11dfe7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772991281, "uuid": "b9cf2d8e-a29e-4f70-a6bd-56bef016124c", "comment": "Malware payload (Mirai)", "value": "3583c830bfeffa85bf920a2880a0c1d435adc66d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772991281, "uuid": "a2d5d92d-167f-41ad-8919-11cafbcd14c6", "comment": "Malware payload (Mirai)", "value": "914c561ad907b6e982c7179e6c1aca1037a08c6c406978987bf5be112cc5367f1fd918c623122167d1f2ad047b881375", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772991281, "uuid": "0aa5ab85-ff31-4a69-8cf7-899d715b297e", "value": "T1EED35C17B5C180FDC4DAC1744F9BF53AED32B1A91238B26B27D4AF222E49E205F1DA54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772991281, "uuid": "16471ead-8b03-451a-9533-e348d27e0102", "value": "3072:79eSuygEPjt6qkWqXdKmDnYMb0gBd/gQyVGsdqml62aj:79eSuygEPjt6qkWq4eH2la2a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772991281, "uuid": "8998dc29-00b5-4780-a477-13ed1979b65c", "value": 139800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772991281, "uuid": "9f1f56d4-4d98-40d4-8277-569729be87a4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772991281, "uuid": "9c7cfd77-906a-4ddf-a049-4af70671fdb1", "value": "main_x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d4fb584-1abb-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1772952798, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772952798, "uuid": "65693a19-6448-43f7-b612-a5bb70f11407", "comment": "Malware payload (Vidar)", "value": "6bf30fb51d7cd2ccda653669278b7056", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772952798, "uuid": "8d98a5a1-5077-4009-8f03-eddbb77508be", "comment": "Malware payload (Vidar)", "value": "2936ef53a07ddd65eedf9365e884af7431659dbbdf1a42e32e19083faff5d07d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772952798, "uuid": "6e4e7b29-ab0e-44c2-b023-e7d9353aeeb1", "comment": "Malware payload (Vidar)", "value": "6605811537f3eca09a6bce9201f4624cabf442bd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772952798, "uuid": "df141c0d-4c86-41ea-ae5a-b8815dc2ed09", "comment": "Malware payload (Vidar)", "value": "bc915e4d956870845a22639401f2512cbfd780a961de871e14fab1749d20612da31ebf2ff81a85fc75c4647c15c56fb8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772952798, "uuid": "b3537837-e8e6-4f6f-b518-aff7aeda1fda", "value": "T10BC6D6AF62A781A8C1798E3AC0628B0097F3717AC737C7E742D307558B269C55D3AE74", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772952798, "uuid": "69d034b6-1a69-4742-85db-774a30e8a006", "value": "068780fe56d60c9502ffe606f8c04be5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772952798, "uuid": "9a6de80c-1b6e-4685-a137-90a248bb1737", "value": "49152:/X18qps+OYzlmB7ki3LfrrOSVhi04X7FOxHZ8mUFqz5L0TVtoeoMwNAcXCBz+COP:WzCoeoTktB37+l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772952798, "uuid": "88e9e4c0-66b8-4ffc-bd85-f8edae37fd16", "value": 11969024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772952798, "uuid": "589604b1-809e-433f-8bc3-30652929d89b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772952798, "uuid": "2a72835f-02f2-4575-af0b-68ac54ac2b75", "value": "1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "764bf8ea-1abd-11f1-a769-42010a9c0008", "comment": "Malware payload (GoToResolve)", "timestamp": 1772953646, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953646, "uuid": "44b308ed-a45f-4923-a41a-984f09247463", "comment": "Malware payload (GoToResolve)", "value": "71ee99413acc62afd6249a71f3f92394", "object_relation": "md5", "Tag": [ { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "rmm", "colour": "#07519C", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953646, "uuid": "1a4f10ca-31ce-45be-a45c-168da69f825c", "comment": "Malware payload (GoToResolve)", "value": "2c2597aa2a1c69d26cf426ce1b13aa0292f570607b93d6ace05cfb999d101fbd", "object_relation": "sha256", "Tag": [ { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "rmm", "colour": "#07519C", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953646, "uuid": "d2c809a3-78cd-465c-8f11-6ecda49a5838", "comment": "Malware payload (GoToResolve)", "value": "1c133f6036bf9a94bb33f62ef09c287246b710ca", "object_relation": "sha1", "Tag": [ { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "rmm", "colour": "#07519C", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953646, "uuid": "8a33754f-4150-4755-b6f6-46fe07e910be", "comment": "Malware payload (GoToResolve)", "value": "8969c75414e359891f22e40582c06430fb13c4a86e1b3274fee3c765b369d60fa0f86ce2675237f2a7cbbb77c9bf3fbe", "object_relation": "sha3-384", "Tag": [ { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "rmm", "colour": "#07519C", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772953646, "uuid": "d8909871-0577-4051-a90e-317b6d5896dc", "value": "T164516433C50F0EE3695126D2C5530E9DDBA50179227018F8354CC46E676ED7EDE716E8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772953646, "uuid": "f479558e-c67d-483d-af8c-9f5ffecf4a32", "value": "48:ETqC6wSo2JId5AmiCwjSwECU/jaZIw5uj2GAlvSjGcEO4SzHi36aV/5v8AftbuMO:/CFSrId5AmiCApECMIIw52dAlvSGcEOr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772953646, "uuid": "adb69264-7ba2-498e-ba4a-fb722085ce03", "value": 2663, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772953646, "uuid": "7567cc0e-626b-492d-a27c-f20b5ace895e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772953646, "uuid": "b0045730-ca80-4008-bfe2-7801d52e7317", "value": "71ee99413acc62afd6249a71f3f92394.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72ca2fe2-1abe-11f1-a769-42010a9c0008", "comment": "Malware payload (a310Logger)", "timestamp": 1772954069, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772954069, "uuid": "0d16c77c-c5b8-406f-b230-8d9f7fb40481", "comment": "Malware payload (a310Logger)", "value": "0c3fcae61c267c10132aaa31eef3bb13", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772954069, "uuid": "48f5f36d-4469-4790-94fe-d483b2dc3f3b", "comment": "Malware payload (a310Logger)", "value": "2c85ee8f659706c0bed71176d9e669469d6c820d38a956b2b6fabcb6df2d6235", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772954069, "uuid": "f41a51d4-6f40-44a2-aa7f-37538fa2de4d", "comment": "Malware payload (a310Logger)", "value": "cd338ed3902fb957a1729b35a03cd80a17be9e3d", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772954069, "uuid": "729ccafc-a6c8-428f-ad28-697ee3f25d96", "comment": "Malware payload (a310Logger)", "value": "e161a517a23737222c687bf0be81546e780a8c3f81c1b5c7e9f830b91b6278e7e376159ad7647b96496920f518ba0a39", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772954069, "uuid": "69c8d198-cc81-4f3f-9c5f-4c917b1ead27", "value": "T128E5BF45E34D272E0C4A45A926BCE11EEA742927304E710D5B17FD26FEABED21143AFC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772954069, "uuid": "70ace42a-d4ab-4852-bfa5-6e619618a17d", "value": "49152:cNGGubVdiUZ3mBBXZd3t0kGItiDPt3X+E4PLBUmZu3g6mqqzBBMe+EXF4Ke+4oSj:N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772954069, "uuid": "b5b33cbd-40b8-4dd0-8701-38e4aca75180", "value": 3088964, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772954069, "uuid": "c9489853-3f01-4223-a24a-f262819abb40", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772954069, "uuid": "52a45278-0357-4b43-abb6-3193b3f6294a", "value": "0c3fcae61c267c10132aaa31eef3bb13.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "391fc9bf-1abc-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1772953113, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953113, "uuid": "63aa65e3-d722-4932-ac0e-932a7272e5e0", "comment": "Malware payload (Vidar)", "value": "79fcab886f84a1a05a09d2b516106447", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953113, "uuid": "38e6de15-31b9-4a2d-984f-9a503733c83d", "comment": "Malware payload (Vidar)", "value": "2c871a66caa73566559e61c3340a44f74c0e4000f25a421f8051139d475c798c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953113, "uuid": "fc72c633-6630-4726-b296-13adef0d9b6f", "comment": "Malware payload (Vidar)", "value": "ae9c58a3cb0595246157afa5676e0a76c6f8c9be", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953113, "uuid": "091f116e-e61d-4820-9b36-2c156e9f5a68", "comment": "Malware payload (Vidar)", "value": "50f9d94a3df5c22ebe0de0372d7a4519d865fd17c36c375e4776566523c2cd24ffc193da9e9723b1911ff943843e0300", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772953113, "uuid": "50bd655a-84e5-4f52-94e6-6da2e81f018d", "value": "T1E2A62A6B6265826CC699CD3ECC57BF40D5F3F0751B32DAD752A003699A81BE34E3E224", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772953113, "uuid": "90479496-1ad5-4cfe-909d-dbfb1fa3537c", "value": "2929b387c156d33bcc782c815d7103dc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772953113, "uuid": "9c40554e-2663-441c-a9c5-21bcb8d0e670", "value": "49152:UrsLnRYcURO6k3uYiOg4wive0dxVS1DBOrj8KVtUcssGF/GWy3ITuBPuGjQx9ys8:UwQCjCTowGjwp2cRpM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772953113, "uuid": "6897fc03-47b9-4772-99c0-9fa90071f183", "value": 9736192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772953113, "uuid": "21b08b8c-700c-49b3-85ea-a6921e64865a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772953113, "uuid": "17d9fcdb-5d2b-4c8f-96d9-ee73e911ee32", "value": "1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9d878a6-1b25-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1772998427, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772998427, "uuid": "49db5708-3f30-4004-8799-2baacb5a5c2d", "comment": "Malware payload (Vidar)", "value": "cff67e5fd2ccd2efb9b4c430ae746401", "object_relation": "md5", "Tag": [ { "name": "pw-ryos", "colour": "#D57FE9", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772998427, "uuid": "8836942f-2494-41a3-9b06-602ad4d96e4a", "comment": "Malware payload (Vidar)", "value": "2d448e3cdcaf941c910cad128a2c421e993a15cf2f35003805a56cf32fe11fd0", "object_relation": "sha256", "Tag": [ { "name": "pw-ryos", "colour": "#D57FE9", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772998427, "uuid": "53c6f0b7-e0bb-4111-9152-4ad1def198b5", "comment": "Malware payload (Vidar)", "value": "ee459b958ab200874ddd49b51561fd55c8e9aed0", "object_relation": "sha1", "Tag": [ { "name": "pw-ryos", "colour": "#D57FE9", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772998427, "uuid": "0df965b8-db92-456c-ae23-9c60348038f3", "comment": "Malware payload (Vidar)", "value": "68570081d826038c7edce8529b1ecbf8e149acda7d46c2840c785cd7f04c326a054a6e3a5704b59ee979a7d7faac8212", "object_relation": "sha3-384", "Tag": [ { "name": "pw-ryos", "colour": "#D57FE9", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772998427, "uuid": "6b9f5b07-6c49-4fa2-ae2a-5fe7294f4057", "value": "T1004633CAD407606FEE83CB00099F962E4464A55AC6BF4836B246D7B0173697C7798EF3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772998427, "uuid": "7f063208-83e8-49d5-a456-84d01f338b9e", "value": "98304:8UrvF6iWUgGyNS7HCkOmPskg80mWSj65ArPib2oPQTcXfVUq6+k8U9AW5U9ZvtbQ:FrN6lnGyNSOZLkg8SVA2CU47Sle", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772998427, "uuid": "ce58f668-fdd8-421c-8988-8be028b99512", "value": 5632876, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772998427, "uuid": "a652d2b6-f0b7-4f9c-a01a-ae25feb68172", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772998427, "uuid": "2ebc7dd6-48a1-4248-815f-8fcb55533cae", "value": "Bootst\u0430\u0440\u0440e\u0433\u044564.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d6bb505-1b1f-11f1-a769-42010a9c0008", "comment": "Malware payload (Smoke Loader)", "timestamp": 1772995587, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772995587, "uuid": "1f1bc337-7aab-4a4c-9ce7-e4c97c5dc713", "comment": "Malware payload (Smoke Loader)", "value": "eaed9344fa4f7694c17ec3eb62ca5430", "object_relation": "md5", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772995587, "uuid": "3f66d104-01ed-4af9-b0ef-66eb19c71699", "comment": "Malware payload (Smoke Loader)", "value": "2d8f3630dba53a26d910008254c7b8ca02e8ff5269422ec5e72f94f081a16bc2", "object_relation": "sha256", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772995587, "uuid": "a9237370-27d6-45a2-b164-601a123a5956", "comment": "Malware payload (Smoke Loader)", "value": "c2e6892bfb527acc8df4d5f933ee51181e0935ff", "object_relation": "sha1", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772995587, "uuid": "cf36fb98-39c6-4d49-a551-46a898a80072", "comment": "Malware payload (Smoke Loader)", "value": "462763152dcd1cb52a0fdda4d080f723243ef8d92a64ed3b3806e7b5f661d279518591fc9ca62f83e3a56428fb133a37", "object_relation": "sha3-384", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772995587, "uuid": "db8f6882-e77c-4634-8479-27aad6a1bba9", "value": "T1C09528066C95C4F6C0A6A336C8A232E6BB74BC049B3263D36E907E783E767E05D75714", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772995587, "uuid": "bae2eba2-c0a5-4784-acf0-19ef86a5f7f2", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772995587, "uuid": "77b14622-e6ae-4ccd-8b06-7a0c46f34f8e", "value": "24576:tW0Pi5VOs9lF3SNX9+RLbVK65+12DeleNK84HTwmlQHl:tW0IVjlhSpK/SdzRlQH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772995587, "uuid": "8b639a37-7de4-4827-9375-6735310490e9", "value": 1892864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772995587, "uuid": "7dd9df04-acb8-4553-9a8f-8869f149561b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772995587, "uuid": "513be5b9-cc7a-4c7d-a975-4bae818569a2", "value": "source code of carbanak backdoor discovered.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e29b5b4-1b10-11f1-a769-42010a9c0008", "comment": "Malware payload (Phorpiex)", "timestamp": 1772989253, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772989253, "uuid": "5ccf8248-ec36-4315-b5a2-f2721d7c6763", "comment": "Malware payload (Phorpiex)", "value": "bc3af3ca2619f95addfc4b13aa8ecd7f", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772989253, "uuid": "45b4fc24-9a7c-4f84-8195-b477d148761d", "comment": "Malware payload (Phorpiex)", "value": "2da6b2024df1d9ea2db71a0f1ba3f614e1dd80fc22721d4d17eef4c8b35734dd", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772989253, "uuid": "e1b8ed20-625e-4018-b050-e8b8d9ead25c", "comment": "Malware payload (Phorpiex)", "value": "dfb1a23cfe84d31065a84302681c26dae90fac71", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772989253, "uuid": "15442e4a-8c71-4763-93f2-0ab1157d7570", "comment": "Malware payload (Phorpiex)", "value": "bbe5c75b2e9819f80956c3ee223b50a832fa560851c58e7753d97b76acf17cff3ea272c2fa7434582756066dc9293253", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772989253, "uuid": "c51cbb15-9686-41d7-b719-c88a420068fc", "value": "T12212080A2F4541B2D3D00DF027B98B9D8A7C457327D261FBF7779A980BA5294E0426AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772989253, "uuid": "34a74918-580b-46cf-b645-3222a22294d8", "value": "552184f3cb48702ba7acb092554c8948", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772989253, "uuid": "6958a1b2-f761-4b62-a6a2-21a93395fb3b", "value": "96:8c18VnoPM0PBmd1erDDykx+ZQHMANOkMWPFJxGE9mZ2FFhyC7tCE23hI:8DJoVPBRx+eHvnPFJxT4ZmFhP23u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772989253, "uuid": "8ef1f2a7-bc1c-4621-8206-5b6ea245e874", "value": 9728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772989253, "uuid": "a7f3e88d-785f-4882-b304-e766e0f71746", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772989253, "uuid": "4cd461ad-01d2-4308-901c-68ab77dc9b48", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d43c8fa-1b2c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773001251, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773001251, "uuid": "aa5c03da-3949-4a93-91af-c6d49179e8f5", "comment": "Malware payload (Mirai)", "value": "ba217746f1e58a688ef04dbbb174bfee", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773001251, "uuid": "0b54e07a-f289-4658-9503-8ee77bacb498", "comment": "Malware payload (Mirai)", "value": "2e8bbc510e516087b4429dbf08ba7bc3dbbbfd779e48da08d823ca6abd1c3031", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773001251, "uuid": "3cec1c7d-4089-40f3-8be6-e843e78864e5", "comment": "Malware payload (Mirai)", "value": "ddd1b42ab868f7550ea113bb4501d55e41b3bba7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773001251, "uuid": "c81ef8b0-69ae-42bf-952f-7e451b59aafe", "comment": "Malware payload (Mirai)", "value": "1481cbed6a411f0731d7377217d40b1d0f8a3fe551586e6bcefec321c818d09fcccdcb5a290132a3ac73407bb4220a0c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773001251, "uuid": "44685c29-50ef-4fc2-9de7-2587ab6e98f8", "value": "T12AB3D85E6F329F6DF16CC33147B78A21D35823D623E1D686E2ACD5045E6038E581FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773001251, "uuid": "3d311b50-0cad-48ff-8e34-e52b342b1678", "value": "3072:035MHTmYRRX9WlpizD37DNOwy13GbZVZI:W5MqAh9WjiXry13G6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773001251, "uuid": "b152fbbe-42ca-41d8-91e8-7db3165b4f3c", "value": 117412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773001251, "uuid": "f3ed8913-8738-4b47-ba74-469dda389710", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773001251, "uuid": "a99ce237-b741-414b-b3da-5d702d9df886", "value": "violetmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "161c214f-1b15-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772991280, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772991280, "uuid": "388c96aa-992e-4f03-8d0c-180b4eb3220f", "comment": "Malware payload (Mirai)", "value": "111526fd88e599da465e24a92172547b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772991280, "uuid": "4c865821-f899-4cc3-a5de-f207191d0fa8", "comment": "Malware payload (Mirai)", "value": "2e9723de53da29335e6983f7daf0b591f9cf9da191980245a0c8c2407a15c063", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772991280, "uuid": "48c2e5ff-778c-4f43-89b0-b82edad81ba5", "comment": "Malware payload (Mirai)", "value": "95d894f41c0500ee2ae77cdb311ddc4e6760c24d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772991280, "uuid": "bef9932e-4bf8-479a-b07e-af5c25ae01c3", "comment": "Malware payload (Mirai)", "value": "bfc071c6b7dcf7c4644db3bb81c12d36dc2d81bd29349bc365a2354e96f26bf5b1710ca955c4df72016f923e038d0b3f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772991280, "uuid": "1a25e38f-9e6d-4462-ba35-875f793c3e90", "value": "T177E32AC7F900DEFAF80AE33648570905B630BBE115921B372257797BED3A1991863E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772991280, "uuid": "5e826232-c46b-43d1-b421-d102c0b0c4ff", "value": "3072:GmzTDH86Jl78HenJljAX0Gidw+w9EEVvjbiQLZrEyqKYtf:G2TDH86JRHjAX03dC9EMLmyqltf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772991280, "uuid": "e8360a84-6d90-49ab-bd4e-e52e9947b79a", "value": 150464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772991280, "uuid": "da89f613-4c3f-4b6b-84d0-2ed9c6dec2bf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772991280, "uuid": "4302b564-3640-4950-a593-d561869b0d59", "value": "main_m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fa7306d-1abd-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772953473, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953473, "uuid": "3ff05fb8-9032-4dc5-9925-76599cf53a50", "comment": "Malware payload", "value": "28996394ce5c951f37ab26171fdec401", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953473, "uuid": "b6f014fc-c964-4eb7-b086-a7f4bdc90736", "comment": "Malware payload", "value": "2fb19e00ce099c77fc9fe17c558e4a318007a7778bbd0c118bf14adab5889302", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953473, "uuid": "58e7523b-edbc-4262-9881-de76d81efa44", "comment": "Malware payload", "value": "8e39afff612a3270c85b79c1a644df11309492c5", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953473, "uuid": "dd01e108-a392-42d8-b488-4568c6aea35d", "comment": "Malware payload", "value": "82d18a5d0d7bca277d234195836205782cd2c81abba43d7cbedd1e44bd155d093ba45fc1d40f51d47c140bc02cf8c5b6", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772953473, "uuid": "236b5a65-a0ce-4701-b2ce-8b3ddbc09c2b", "value": "T1034125141AE51718D6F38B3AB8BEB3119976BC15EE62CFCD0150618C24A1520F5B6F2F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772953473, "uuid": "3366cfdc-7dd8-4c38-af21-f5545bf02c13", "value": "24:8iw/BHYVKVW2+/CWusU5+HEEV5yAoq3UMkWIp0+/E4I0arab/WlY:8iU5aysU/EV5yAoq3HVAIZabi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772953473, "uuid": "7b5a3b7c-3e2a-4ea7-b5db-7221876b63d5", "value": 2238, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772953473, "uuid": "68c0ad9d-fa29-4950-8f31-8a404cfc5873", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772953473, "uuid": "1cbd7dd7-6908-478d-abe2-23b9297ff4ab", "value": "28996394ce5c951f37ab26171fdec401.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69749d11-1aca-11f1-a769-42010a9c0008", "comment": "Malware payload (NetSupport)", "timestamp": 1772959208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772959208, "uuid": "c6778967-818e-48e0-9567-8268f510b8d5", "comment": "Malware payload (NetSupport)", "value": "0b3607e89f14388f4dc181a3002bc3d5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772959208, "uuid": "47a96769-6b14-451b-9fdf-d4c0f9a5aec7", "comment": "Malware payload (NetSupport)", "value": "2fdaffdac4758c1c4cfc3f5a8360959bbb717cbafb478b9a888ecd55aad7e2e6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772959208, "uuid": "7491714f-4f60-4930-b883-9541be5c4282", "comment": "Malware payload (NetSupport)", "value": "7a10f3a27b53b6a73f2b2d405c3aa2ab77136115", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772959208, "uuid": "39fdad34-f388-4d2d-a264-ebb08a1977ec", "comment": "Malware payload (NetSupport)", "value": "90cb747c4bd4156c95e8bf8cd3e4e9c47c13f4fc3ba73fb581a3b8116a361bb4fc66b49ba8359a47cda1d3c97fe4ef72", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772959208, "uuid": "f7782a99-df90-4873-a673-5f8d378e1661", "value": "T1D1D633A0A6E811EBF9EA933DCC528991C4A676673B49C183C3F8D5E12C733C4697E705", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772959208, "uuid": "22c0be6a-4e35-44dc-b268-95418cfd88e6", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772959208, "uuid": "0a9611c1-c452-4308-a426-2256079cb580", "value": "196608:y14oWUoB9qLZBFslHl7dZgnRMWF3y99TisLkuorFYu8ouurH/P/XRLSq2KKeF:y14FSsFl7dCR1C99/Lkuu6puDX8W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772959208, "uuid": "b8c1f9f0-9534-4d16-b420-6dd1541fa6dd", "value": 13422788, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772959208, "uuid": "c7e96d20-662c-4660-b50a-8be04796752b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772959208, "uuid": "a22de19c-484e-418d-8868-f73734da3f55", "value": "0b3607e89f14388f4dc181a3002bc3d5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "870fb24a-1b1a-11f1-a769-42010a9c0008", "comment": "Malware payload (Smoke Loader)", "timestamp": 1772993617, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772993617, "uuid": "2bb1980c-dd06-4f4a-a9f8-402c6b28c5cd", "comment": "Malware payload (Smoke Loader)", "value": "9efeb92ced57f5249eed2d6fe1bb6d28", "object_relation": "md5", "Tag": [ { "name": "baxe-pics", "colour": "#3BA02F", "exportable": true, "hide_tag": false }, { "name": "dropped-by-GOLoader", "colour": "#EF34D1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772993617, "uuid": "8fec8ac4-979c-4bb2-baee-9b8f5e8fe19c", "comment": "Malware payload (Smoke Loader)", "value": "304fc4545d13d71baa721f97ae3f77cce585b5c9772685d2004fdf4568ad676f", "object_relation": "sha256", "Tag": [ { "name": "baxe-pics", "colour": "#3BA02F", "exportable": true, "hide_tag": false }, { "name": "dropped-by-GOLoader", "colour": "#EF34D1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772993617, "uuid": "3b6d89be-8548-47de-9a62-e3df8bb6db34", "comment": "Malware payload (Smoke Loader)", "value": "5173181f559b3d96a5c6dda8f52eeff4add3433f", "object_relation": "sha1", "Tag": [ { "name": "baxe-pics", "colour": "#3BA02F", "exportable": true, "hide_tag": false }, { "name": "dropped-by-GOLoader", "colour": "#EF34D1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772993617, "uuid": "db2830f6-a76b-480b-a663-a7b9ec000112", "comment": "Malware payload (Smoke Loader)", "value": "0318cf7af58ca0b6f22fa9cce856ab870b147f860805438b767476c8e649ea53aa1ffb2b97b996963fceaa966ca9900a", "object_relation": "sha3-384", "Tag": [ { "name": "baxe-pics", "colour": "#3BA02F", "exportable": true, "hide_tag": false }, { "name": "dropped-by-GOLoader", "colour": "#EF34D1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772993617, "uuid": "13a585b9-c74d-40ff-99ec-260b4f36d984", "value": "T18C855B06BCD014BAD06AA33288B352A2BB71F8194B3237D72F51AB783F767D05A35754", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772993617, "uuid": "5148b662-34ce-48dc-8b23-8bb241d3e4c7", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772993617, "uuid": "68dc0b2d-9953-4d07-b188-8af775ee3af5", "value": "12288:I5MYjWvRF9OEMEIhg8hG6BCMINIZyUe5Zy4ZauLsPMloI8Z7GWdzkDMKbGKSonPP:IaiCHsQIW8oywBLshH7GiWkKS05YK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772993617, "uuid": "092ab424-1b1f-4ac0-b1a2-b59d07e03899", "value": 1731584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772993617, "uuid": "6a27b1e5-05c0-4d9d-84fe-01f0f9e0a447", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772993617, "uuid": "b896cf6b-a2d4-4c6b-b03b-ce4d17eef543", "value": "byGemLHrVWxq5Iis_hpjIovG.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "135cf0f4-1b19-11f1-a769-42010a9c0008", "comment": "Malware payload (Smoke Loader)", "timestamp": 1772992993, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772992993, "uuid": "a4939d07-cc9e-4a34-9bb2-074c57393883", "comment": "Malware payload (Smoke Loader)", "value": "e455b75f8c34676b6400b4b89a9706f6", "object_relation": "md5", "Tag": [ { "name": "baxe-pics", "colour": "#3BA02F", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772992993, "uuid": "1f3b0332-3537-4bbb-9e7c-44fe6181b5bf", "comment": "Malware payload (Smoke Loader)", "value": "307dabc196934b338d2dc0fcfc37e7ecd3b79b5224139051f799d10053b8fd8e", "object_relation": "sha256", "Tag": [ { "name": "baxe-pics", "colour": "#3BA02F", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772992993, "uuid": "5c84dd01-be5f-4f7b-816b-43683058c4aa", "comment": "Malware payload (Smoke Loader)", "value": "dd741c60ab03f6803d65d97d297f9bc246fc9b1f", "object_relation": "sha1", "Tag": [ { "name": "baxe-pics", "colour": "#3BA02F", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772992993, "uuid": "1d195ae4-9e38-4038-a3dc-78998dab96f3", "comment": "Malware payload (Smoke Loader)", "value": "61ea2e31e1dedbac369efa24a716a4774706a72aa89d9ae4c4925d1ae5c4146c551c2686e774bdc68620e326b979b4c7", "object_relation": "sha3-384", "Tag": [ { "name": "baxe-pics", "colour": "#3BA02F", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772992993, "uuid": "a32957b7-a57a-4ee0-ad2c-a4a2d60f4ce0", "value": "T11177BE12BBD840A5D0BB9234897B9756E675BC210B3097CF2254BB6D2F33BD05E3A712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772992993, "uuid": "f72205ee-3bec-4546-b0fa-c037969fe2ee", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772992993, "uuid": "e5cbad91-12cd-463d-98d6-27f24cef8f83", "value": "393216:twIRhg004Wft6MUt/mvj/LGNyf5gs8YTnEFvcewZHZDx:twIRhoVPOCgSnAWHb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772992993, "uuid": "3acf9ed4-9019-46b5-956e-536afa164e06", "value": 34198528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772992993, "uuid": "c5fac26f-a7de-4dbb-a487-0e98118a028f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772992993, "uuid": "4b0e0e8a-14bd-48c0-bb9c-475b792cde38", "value": "source code of carbanak backdoor discovered_patched.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cbe6b9e-1abe-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1772953952, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953952, "uuid": "9d535d0c-ee0c-4054-a0d1-cfc069a6c0ac", "comment": "Malware payload (AgentTesla)", "value": "65aa11a2e2cb1ab3824e20dfd7c1dbbb", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953952, "uuid": "069c0106-8a0f-4365-9b9c-b83d015eb99c", "comment": "Malware payload (AgentTesla)", "value": "30ab1ebd21cfd4ad826ff2a758764972f0fef81abf011f904599a3ed8bef4170", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953952, "uuid": "170b2eb9-8602-40fe-a620-031a471cced3", "comment": "Malware payload (AgentTesla)", "value": "c856b13e207feb15f2ce1c6b22f0a134f9752769", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953952, "uuid": "2447b2d0-bc21-411d-b837-d0f5d2f5420b", "comment": "Malware payload (AgentTesla)", "value": "6a87b501d2641a1a071fe2e779c39749b633cc1f5a3a1f6dbf13e51f6e49b12c20da8f6359c0e41194e3546a815c24b3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772953952, "uuid": "3b1a66f1-fb59-48ab-9c9b-671709bcd029", "value": "T1483665541B88A16277323FACA86A9961BC09108379C79F05315DE736336CE0F672E7DE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772953952, "uuid": "69143c2f-42b8-427e-8c5d-82fa48477ede", "value": "98304:bfsFiThkyBY0yX2fTROOHdoorLfVpIcGHbJFYq:bfsFiThkwY5GL0O9osfVKR1P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772953952, "uuid": "c7abca5c-6302-44d8-b6c1-0e4eb79241ef", "value": 4997115, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772953952, "uuid": "e64f96ae-1701-4a4b-a067-5560cdb5ba55", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772953952, "uuid": "2bc3f3a3-3eb4-45f8-a897-01dab30423a5", "value": "QUOTE.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3193169e-1b29-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772999916, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772999916, "uuid": "5cc6c896-ae0e-4ed2-a82c-e6795685051f", "comment": "Malware payload (Mirai)", "value": "849c6750cebf671cb38a0bef745c6105", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772999916, "uuid": "0d435cfe-4992-42d2-a5cc-3cc0700b0666", "comment": "Malware payload (Mirai)", "value": "30fdf92a3d8040ac1d65cf7d66bacf3fe424aa26e35b60f882feac50399eea8c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772999916, "uuid": "572ef95f-969f-4279-a41d-9c9124fe70e0", "comment": "Malware payload (Mirai)", "value": "4dd52cd6a7ffc88100c1071389b9bdaf6ac03347", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772999916, "uuid": "479985de-0434-4807-86be-fa719a3f1ab4", "comment": "Malware payload (Mirai)", "value": "1578dad62d7fcd6c0c5d760a31e2c0728510a462da196abe1608bed9758f79e7129b13f2b5f0b904f1a5955163c5944c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772999916, "uuid": "e20faf19-f5d8-48c0-82fa-017c1e82014c", "value": "T15F2419C3B901FEB7F4CAE77204D3872171B1BB514B531622B29779799A3A2C4342AF49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772999916, "uuid": "9ba6cc83-313e-47a6-9351-e83239e08181", "value": "6144:Ot4Oyz6bDcgqBrkj490LaGq5bmI0NnY08Y7SKMPH38t+:OZcZkkGqxmI0Nnl8Y7SKMPH38t+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772999916, "uuid": "c901a775-d10c-4744-b6b4-e0dc9c06c092", "value": 218332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772999916, "uuid": "56c4df6d-a022-4579-be22-9c263f8ca4fa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772999916, "uuid": "a7bd7653-ac68-4280-a6dd-85ffc703687a", "value": "i-5.8-6.dick", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4502eb3-1b29-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773000243, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773000243, "uuid": "a5cabd8e-c9d2-4ea8-869e-279fb97e9615", "comment": "Malware payload (Mirai)", "value": "6059d186679e5580facd2850e2ba940e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773000243, "uuid": "6ac3d027-5be2-4820-a0d2-ec4755e4e006", "comment": "Malware payload (Mirai)", "value": "33b901ba6dc8829b096e394b606c0f09c39d26d03ccc27000737b72591a0fac7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773000243, "uuid": "3ffc9163-68e8-4c67-b68a-7ef4f51d1317", "comment": "Malware payload (Mirai)", "value": "428b91321261fce0b5a9dc42087403830763cfa6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773000243, "uuid": "df7bd83b-ce54-4e9a-9155-00acb93a6bd1", "comment": "Malware payload (Mirai)", "value": "64f41d62140bdb112084bca9314ff91be761d67e014b83871b7bc03fe4dd60ca75a17e3a00d4f5ffcddfea0e5d88c912", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773000243, "uuid": "8a9c79be-5f5f-429d-b9a2-156816431f58", "value": "T1F4D32823E8269F1AC21790F0A1F54E781F42BD994A571EB9A4B6DEF44143CCCF505BB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773000243, "uuid": "76483f28-6ae6-4252-b2ff-df9c7ed22bdf", "value": "1536:Ta6Mv/0jbYhIJN5F7nHFUCLKSfoiPGtvnhK1OWJKYFPgz9ZYoS:T9MvcjbnF7nqLSktvo1OWQYFm9+oS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773000243, "uuid": "35851b80-3ffd-407b-b87d-387b4dbe6a45", "value": 130456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773000243, "uuid": "dc41995b-aa07-4239-9235-4e83abbf1ff3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773000243, "uuid": "fba13c87-fd35-4e9c-b207-4e2c4c9b9752", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40e84311-1abd-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1772953556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953556, "uuid": "16e47a5e-3d81-4a12-a2bc-4662ab9892ab", "comment": "Malware payload (XWorm)", "value": "bf4753a6731cf672c78d4c02685dcd77", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953556, "uuid": "eb64b5b3-6349-4bc4-b46b-fc8846815ff4", "comment": "Malware payload (XWorm)", "value": "341343a9a49fe35155b595825e762621605bfe38c7b2716b49740f640c006a0c", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953556, "uuid": "cd68149c-c57d-4534-af9e-0a9ac3679c19", "comment": "Malware payload (XWorm)", "value": "e86827df99db0f4b1a40fa316cf94f40a8a7fe13", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953556, "uuid": "448b664a-3205-49f6-983b-c33d1763a476", "comment": "Malware payload (XWorm)", "value": "b147f6a00da4a2976ee2f251846b9da90472474aafb69369057f39cf3e06458f26eafebbaa659c58497251441ab77f18", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772953556, "uuid": "3fba762b-9974-417c-a493-94e67c87ae01", "value": "T10B453C51E04844868A3F4F8F9AF9ECDB7F7DBACD4826AC05F38D048C664EB5CB425568", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772953556, "uuid": "912c2f4c-ac34-425f-b208-82d422f0d32f", "value": "96:LZMsRWjwhV4HrNGZ0IqoZG157ra8pXI+FMFqT2EsEWSbpr3H365AVkG440ab0o7N:LTRWjwh8IEKQxn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772953556, "uuid": "92c8d882-b650-4b99-a772-c5fbc1b5917b", "value": 1237498, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772953556, "uuid": "e8ad3186-29ac-421a-bc48-48a0c39a5424", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772953556, "uuid": "520b35f9-1a77-4e79-b374-965068cf73bf", "value": "RFQ - EM78625.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ef23d82-1abd-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1772953580, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953580, "uuid": "4897a192-1222-446f-9614-28839912545d", "comment": "Malware payload (XWorm)", "value": "bfd0900a8cf85d1d2791a0024b9eb524", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953580, "uuid": "28d4755f-a6dd-486d-90d0-62f78659d767", "comment": "Malware payload (XWorm)", "value": "359de383c3f01c6c7779475b62201843336463ee2ffebe0f3573b46f75467c33", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953580, "uuid": "9e6adc3f-9107-43f3-a8d8-3c0fa47df51a", "comment": "Malware payload (XWorm)", "value": "4ced3901fb3ba341f5eaa7a5c7c94f896e507355", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953580, "uuid": "8fe732b0-cda9-4dc0-8ef5-e61fc69286df", "comment": "Malware payload (XWorm)", "value": "d6a232c6b144bf2a54fc10a64b9b8d407f552f047412607a53461fac54242dec75cf1f1d2ca9acfcdefca186540ec2f6", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772953580, "uuid": "0fcad318-7c68-429d-906e-2b8de34a7335", "value": "T192551233850040E6AA941C7FFDB9EC599E551BEF5B45C08BFE216B8026C51D34EEAF0A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772953580, "uuid": "ecd2bf46-c0a3-4e85-a696-658ebc7e4a88", "value": "768:Ht/t/t/t/t/t/t/t/t/t/t/t/t/t/t/t/t/t/t/t/t/t/t/t/t/t/t/t/t/t/t/3:R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772953580, "uuid": "191e6644-1fa4-4545-b339-3b80bfab15cd", "value": 1294069, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772953580, "uuid": "ba561395-fcd1-4290-9928-068675d08d3b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772953580, "uuid": "c8ee87a2-0ba4-48bc-b581-5dc4c0e7fcc3", "value": "bfd0900a8cf85d1d2791a0024b9eb524.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a565be7-1b11-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772989650, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772989650, "uuid": "68b5ab71-fe68-4dd1-85a6-94701509cb47", "comment": "Malware payload (Mirai)", "value": "2294bb55aeb814b2eb35d615777b4fe9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772989650, "uuid": "949c8a51-7887-4caf-a1c3-25e9d4aa7ca1", "comment": "Malware payload (Mirai)", "value": "386df894285f8910c11d4823a39ec3b7dfcdfbbb9fc55b18bab756761b04f7f2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772989650, "uuid": "9e17c21e-1ccc-4d5a-8c8b-f97beb99a5fb", "comment": "Malware payload (Mirai)", "value": "ace2695aa54de0c3dcd97e61faadcf4c98ecaf29", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772989650, "uuid": "0fc8a1fd-5a42-4f87-b514-9663ca00349b", "comment": "Malware payload (Mirai)", "value": "c87ae94d198dbccb041c303b37a16fed39bcc417b545f3165d5f2ea91f66c83642cf88a811b96a4e886365877a51804e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772989650, "uuid": "35415913-c8cf-4ffb-82db-6169fbde43b4", "value": "T11945336609B4E7A1CA9EE0FF6151E45F5C018D04F0A96C2DE43D213B8BCD1A5EEA1EC7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772989650, "uuid": "eeb50ae8-6140-4569-ab31-c1b7690109bc", "value": "24576:/Cz7dGWUQaYz+6Lve2MPyFtYbWCfj/DMr11PETIhjV:qtHUt6LBgyjiRMx9mI3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772989650, "uuid": "ed6f7ee7-ac6c-40ae-b9a0-1cc0344c2399", "value": 1208604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772989650, "uuid": "35b00fb7-d68d-4984-a512-630f7687c49b", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772989650, "uuid": "dedd47f1-08c6-4348-8de9-3c98a885ac36", "value": "armv6-linux-musleabihf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47809974-1abd-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772953567, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953567, "uuid": "978e0ed8-84ea-488a-ae93-d8b86ad65c86", "comment": "Malware payload", "value": "d058ce430638a51cb31944b3d8b65af3", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953567, "uuid": "13be2907-48ea-491c-bd1e-4a1d7f352ad5", "comment": "Malware payload", "value": "3ab96b0ca50b7e119dbe9597007b0bf6f62bc47e44eef41304b79b1277667fb8", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953567, "uuid": "5f49e401-1f5f-4437-862e-4b80cb870b06", "comment": "Malware payload", "value": "c745868a2f2af1291966819a4b15f67ae90589d8", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953567, "uuid": "eab49760-8067-4ae5-9554-e8b3cb88c4ef", "comment": "Malware payload", "value": "8c026c5f1b40ffac5f994fb6db1494f64fb37688f8b5efd9553e4c7f41124dc165e183129940cc780a5de76b5e73280b", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772953567, "uuid": "87656870-d4b4-4a71-bd56-938c6dfb4fa4", "value": "T193C41D0DD3E5369BF1695A82CD960F39C738F04BDC12407F7E1BD16BE612B0D6610AAA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772953567, "uuid": "86d3a96d-1042-45a1-861c-d6b074fcfbc6", "value": "3072:lIgG/9yQpUs8EyosJXs+spsU4TYvGLGBGL+KzHJdPbIlPJTzh1hBThTWPRyDIUOq:a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772953567, "uuid": "05faef48-8c0c-4ebf-87c0-69dc3bbed98b", "value": 565135, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772953567, "uuid": "df4a75bc-934a-4200-b6be-2ff91d8b68f9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772953567, "uuid": "6e9f91b0-09cb-484c-8931-4714cb6ad083", "value": "d058ce430638a51cb31944b3d8b65af3.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d513306-1b18-11f1-a769-42010a9c0008", "comment": "Malware payload (Stealc)", "timestamp": 1772992795, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772992795, "uuid": "cc543833-ba0a-458e-a301-c6d0e6df37e1", "comment": "Malware payload (Stealc)", "value": "0f2198bc8d9de74c454f3cdc35f3fb42", "object_relation": "md5", "Tag": [ { "name": "80-97-160-190", "colour": "#FFCA15", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772992795, "uuid": "b3b8b7ab-588d-4f72-b735-63a829d2204d", "comment": "Malware payload (Stealc)", "value": "3b5e6b20a192f2b3068ba93b216d6425936f665fd02bd90961d2f83e83e98b5a", "object_relation": "sha256", "Tag": [ { "name": "80-97-160-190", "colour": "#FFCA15", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772992795, "uuid": "e6e9e1f6-ba2f-4493-987f-8e4360ab7957", "comment": "Malware payload (Stealc)", "value": "e8422f3356748c77b6b1f605c8bfa7e4dad13332", "object_relation": "sha1", "Tag": [ { "name": "80-97-160-190", "colour": "#FFCA15", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772992795, "uuid": "ca38c38a-e58b-48b5-9ae8-380936801093", "comment": "Malware payload (Stealc)", "value": "3e810f734a7d743425a572bfc20b62822834a68fc19a98a5536256c2787e01b4233dfee5e78ed78fe0d266579ff249c4", "object_relation": "sha3-384", "Tag": [ { "name": "80-97-160-190", "colour": "#FFCA15", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772992795, "uuid": "f6ccfe0b-2117-4431-9e3b-1c824ffcade5", "value": "T1ACA6AE06BAE840B6D0BA9234C867A766F771BC154B3163CB2660BB7C2F377D05A39711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772992795, "uuid": "6e09d337-5eaf-4ec7-a6eb-5445fdda4c4a", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772992795, "uuid": "8a9eb2f0-c259-4484-93da-b527b2634119", "value": "98304:hxO35KhM3QWlv6G0llxWd+aUkaxY8JRMP5NGHQ:hxOpKhM3flCG0lPWd+aUkaxY80", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772992795, "uuid": "7cf4dd0f-a388-42e2-92e2-aa1eee66f552", "value": 10102784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772992795, "uuid": "b4730b14-bf13-4973-a4b4-ef28638ef6eb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772992795, "uuid": "216d20e6-6c1c-4c18-bfa1-cd5c1b509e5d", "value": "recuva_professional__technician_(2024)_full_espa\u00f1ol_[mega]_patched.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9e80960-1abc-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1772953410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953410, "uuid": "fd5aaa2e-0fb2-4e6e-b4bd-7476a5ff6558", "comment": "Malware payload (XWorm)", "value": "11dccb8abcc463358b2360622b9244f2", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953410, "uuid": "adf14d85-3aab-488a-87d1-4c0f7289f3c6", "comment": "Malware payload (XWorm)", "value": "3d72baf9cc8efbe5cbada973416f32250b312120819acdaf120dd4f4d6b1b086", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953410, "uuid": "57a47c2b-2c46-461e-98cd-0feac72ebf1c", "comment": "Malware payload (XWorm)", "value": "3bd3ce3faefe9e1da415f3500762b3432f0e9c66", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953410, "uuid": "4ba55665-ff72-42af-bfa1-592787d646dd", "comment": "Malware payload (XWorm)", "value": "3c931abcd87af45e81b4f00fb1001629bd450d9807b336543e707a41483125f0d800667a8b459640a0ecd64681ac5e4e", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772953410, "uuid": "805a5539-dde5-42c1-98f5-c96d87a5cfbb", "value": "T14335F627D861F0800C24FF429A6E6231FE8045DABE1B15ACF18685DF596B4DCF726B39", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772953410, "uuid": "c3cc6532-5962-41a4-9a1e-fb702a6677b8", "value": "384:5KKWhL77PWYIi0IYhY+7QPhkyP5kDQ7PIYJQ0kYh7PWK050HYJ2HrikWIl0jJPaM:kQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772953410, "uuid": "af373175-53e2-4b68-a718-a1ae07431883", "value": 1161910, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772953410, "uuid": "ccf0d94f-9ad6-44c8-8104-58363d785512", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772953410, "uuid": "f90e79cb-6420-4f72-a3bd-7ad640130cb4", "value": "11dccb8abcc463358b2360622b9244f2.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9b147d9-1b29-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773000225, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773000225, "uuid": "fe83445c-16a1-4a38-bc6c-e4cc10eb16ff", "comment": "Malware payload (Mirai)", "value": "7b621cd9d816b302515b5d12c7eb3c38", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773000225, "uuid": "30a092d7-41b8-44ee-a593-ae624ab3fabe", "comment": "Malware payload (Mirai)", "value": "3ddac37e3bb8b98830aff918feb256a0e34413afe6aafcd338c3859cb23b3242", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773000225, "uuid": "9236e881-b485-41a4-9fe8-42ce8dda2082", "comment": "Malware payload (Mirai)", "value": "05d7f28b6dbdc33d5b79683a2d8d7113659d31c4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773000225, "uuid": "8dd4c65f-ece1-46cc-b105-1a6f543e8759", "comment": "Malware payload (Mirai)", "value": "35f779788882f4c7c76c98863c9516b3fd0b900d251b15582f84d57f930037b780f4d7b477dd7ea2ec9e0474fae77166", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773000225, "uuid": "e6672a9d-a9ee-4d61-8b0c-6942e76f554c", "value": "T14C14E50A7F520FB7DCABDD3702E90B1128CCA80B26A53B757674E964F50A58B19D3C78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773000225, "uuid": "72a002c1-dd9f-4bc3-a260-0aa5a0c5ca10", "value": "1536:fLq52X5YsRTupi0+u/K2YhQ14WcYIg26DPV+NUPBdZyqGiJQonKY3JbqhCiTZGoj:fLq5s5Ycq9K2bkUZdnRnKYZbOYo0LW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773000225, "uuid": "edb65557-9be2-4414-9e26-793a1a5eb219", "value": 192004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773000225, "uuid": "ecfd9dd4-5c3c-4ad1-8353-29a13dd08ecb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773000225, "uuid": "08110daf-b4f9-478f-9ca3-6a03508f32db", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96f26f9c-1b29-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773000086, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773000086, "uuid": "d13f3dd9-7037-4638-b5b0-ea3601658225", "comment": "Malware payload (Mirai)", "value": "e45cd68ef57f4647bd5a05721b188d25", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773000086, "uuid": "edc973a3-87f4-4c25-947a-8a8854f2b067", "comment": "Malware payload (Mirai)", "value": "3e6b6bcdcbab757cd676ad96e8f10921570df199daa56974c29ef089eacd2182", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773000086, "uuid": "2dcfe5dc-5ef1-47f4-bc32-48a5a1652035", "comment": "Malware payload (Mirai)", "value": "0052221bb46cdef6cc498903add3c14a715a3754", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773000086, "uuid": "a1090bc8-91a6-4417-ac85-9acf686d6713", "comment": "Malware payload (Mirai)", "value": "1e5a7fa9341eb29d05f09a3bc7ad8cccfbb5192e5441f68133eafb10d724ef5f7871a256612852176f1cde77e7415aaa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773000086, "uuid": "0f9f66e6-16de-4c83-9d76-0b327558eb50", "value": "T1E2735DC2F743D4F4F85704702177FB3B1A32F1B9112AEA47D7A89A72EC52601E9166AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773000086, "uuid": "68d1ea73-0b35-440d-8f5e-df387a4c63bb", "value": "1536:LuUTFqS81l4OGv9p3XPUhOu4FRbuiE0wvNP3IuHnUCUHjUKtgShP:LuUxqS8frGv9tXsh10eNP3jHUNDPP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773000086, "uuid": "eb21bb98-1d5f-405c-82c6-aafc01499cd3", "value": 79248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773000086, "uuid": "227d1001-79e3-420b-b537-491db2c53b59", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773000086, "uuid": "fd23b75f-0f76-4502-9f1d-04fcc82af9c1", "value": "x86_32", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d29e487-1abe-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1772953979, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953979, "uuid": "cf943665-3a37-4405-a2e3-0efcc10dcbd6", "comment": "Malware payload (AgentTesla)", "value": "bfeb3f5f6a804a4489fed7910f0f34c6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953979, "uuid": "ffa24619-f881-4231-90c5-7664900dfb92", "comment": "Malware payload (AgentTesla)", "value": "3e877ba796a8aa6ae9f7edb403e8009115da305d050ba7f55241fdd8a50b5b29", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953979, "uuid": "169a387b-0f34-4895-b6cc-4fcdb05e687c", "comment": "Malware payload (AgentTesla)", "value": "4a1aff75c5cd07cd1f26748512c2f13ab4ac7d01", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953979, "uuid": "e801c96a-ca9e-4cfb-9d64-9cb4d02eb448", "comment": "Malware payload (AgentTesla)", "value": "f7874bffe93051bf5dff11ccdd7458c435814b691389806b6265cbf71ab45300ee8a563bbac827365c58d33754e14b53", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772953979, "uuid": "68fcefdc-ca4e-45ba-a3d9-01e289cdabef", "value": "T11C45BA61FC092F94927DD48D91E0ADA1DDB6A6B524C08F29CC87D2F88CA779448F37B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772953979, "uuid": "03ee06ba-5e91-4dac-a162-058ccaa29bc2", "value": "384:HzkZFdbSYN9Diz2xqJ16GBs7F/ATOhwbnmic/eQV0hfXZ1Mud/LJCs4QmQEHyvRc:o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772953979, "uuid": "5d9b1ec7-04cb-495a-88c4-10a53a78fe68", "value": 1206929, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772953979, "uuid": "a338d18d-1849-4524-99a7-da08fe3f0ea5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772953979, "uuid": "5cd205f2-e9fd-4b12-9ed8-7ebd6045915d", "value": "bfeb3f5f6a804a4489fed7910f0f34c6.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f23da426-1b29-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773000239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773000239, "uuid": "753837c5-ca67-4a03-8b2b-75b5df5d16fc", "comment": "Malware payload (Mirai)", "value": "36b2ba6114251e7d4fd58ec93bfde3af", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773000239, "uuid": "b3734b00-8be3-48ff-9c08-7fbf8a25c832", "comment": "Malware payload (Mirai)", "value": "3f8c6533f521847a5dea1e2ab07a114ab82a3860fc5df30257878f3bd1ed164a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773000239, "uuid": "84232fe2-1403-4bb2-b061-5f1429eb9696", "comment": "Malware payload (Mirai)", "value": "769e1499c633a1005238434a63df834eb9d66f49", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773000239, "uuid": "27b49b0f-9c3e-4efc-ad0c-5e6dbac11824", "comment": "Malware payload (Mirai)", "value": "90ba14723d9c2eebbec7c9d2befa350e25d895d9e82eab3058da8c659588befeb2d1e739cd40eb25af7b0d168885da76", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773000239, "uuid": "c2262335-78f6-4561-b781-268742666c2f", "value": "T11CB2E1346A17C4B0F360BC36FDB9C70A8B17357B97B434320A609B7D765868725B825A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773000239, "uuid": "39668ddd-f4bd-4ce3-b06f-8774f6d465f2", "value": "768:BgRmftmORW2o/H0iPjmNc0njAfZws3Uoz/kJ:yw3W2mO/cfZlzMJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773000239, "uuid": "c3ba2606-625a-4209-afaa-bef7d8f45534", "value": 25580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773000239, "uuid": "bb5ec9e3-d669-4c70-b338-088e1b11195a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773000239, "uuid": "a6892626-6ca7-4bff-b724-f147d6394d02", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4972eec4-1ad6-11f1-a769-42010a9c0008", "comment": "Malware payload (njrat)", "timestamp": 1772964308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772964308, "uuid": "5de8a3e7-ad4f-4ccb-b552-a67e5481c3d2", "comment": "Malware payload (njrat)", "value": "0d08b31cea0d77c314b0700fa09a0f44", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772964308, "uuid": "0c901ef3-ebdc-46b9-814b-75d5a65a9b22", "comment": "Malware payload (njrat)", "value": "416c01c8f1851f038371bda07ffda846b809eb1e7df28344e2ee7b208539b1a1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772964308, "uuid": "9cbdcecc-bc10-4bba-9cbc-be16a07e4487", "comment": "Malware payload (njrat)", "value": "fb8029f7c9c7f24c42c5264959120c3e92b13b3b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772964308, "uuid": "efeee383-4251-43d5-8f14-cb771e4fe10a", "comment": "Malware payload (njrat)", "value": "2b1b12dcbb2384b22dac44340f691fd23a6c3536946f763d68ce7d6a79acf91bf47fe063c490f8b93a77c557119f2939", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772964308, "uuid": "c29e5898-eb99-446c-8dad-8b3a4fcbf016", "value": "T1E0032A4D7FE18168D5FD167B05B2D41207BAE00F6E23D90E8EE5649A37636C18F50EE2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772964308, "uuid": "72a7f3b7-3792-4761-8d84-1cf746155fc2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772964308, "uuid": "2bfaa074-c60e-4225-bb49-ca075deb57a3", "value": "384:6KCBkiy/nDNGRn5IyUveIXfPca/icFmcrAF+rMRTyN/0L+EcoinblneHQM3epzX1:Pz5M5jUvDX9qcEcrM+rMRa8Nuj5t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772964308, "uuid": "28cb682c-ccce-480f-b446-d37320ed2511", "value": 37888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772964308, "uuid": "f202d1e8-a88e-46f1-901c-9132a3ed881e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772964308, "uuid": "b5e59891-41af-4540-9ae8-0da11ac01c70", "value": "0d08b31cea0d77c314b0700fa09a0f44.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "281a6e66-1aaf-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772947501, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772947501, "uuid": "bd3c71b6-a4da-4198-9ad4-8f0e2d64eff0", "comment": "Malware payload", "value": "d769e2e3704f75dcfdf648cd141ad180", "object_relation": "md5", "Tag": [ { "name": "pw-2201", "colour": "#4EA58F", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772947501, "uuid": "d76e84db-148f-407f-964d-dbf611577839", "comment": "Malware payload", "value": "417e0842547a96033ae55875079674a0cb9c64c89bdf2738f9e21235a141fded", "object_relation": "sha256", "Tag": [ { "name": "pw-2201", "colour": "#4EA58F", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772947501, "uuid": "031b37ea-db01-4d6f-8eac-dcf7902e02e2", "comment": "Malware payload", "value": "1cfa1fa37934a617e19d6446a1ff60dd9a04c92d", "object_relation": "sha1", "Tag": [ { "name": "pw-2201", "colour": "#4EA58F", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772947501, "uuid": "21966481-15b6-4d19-9bd1-9f11d7aa6884", "comment": "Malware payload", "value": "09fd3fcab2e652688eedabfd565e4f2fafd6237479f1690dbbfe49ba4da801ba658665d5f0de5e2770f49d6303c08d45", "object_relation": "sha3-384", "Tag": [ { "name": "pw-2201", "colour": "#4EA58F", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772947501, "uuid": "1c3512cf-7278-45d7-97aa-4d5539f8837b", "value": "T12AA7330B28A9D08ED333DDDB75C396246F01F5DA65A0114F903E9B1BAAC45ACEFC11B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772947501, "uuid": "3ac05869-d66d-4900-8088-2099d06072c7", "value": "786432:o6h2ErUcNTJ7b8Vy3Q1N1HmE+s7sgcgyrjk7SZI1S4BQSIukF4:/2E5J7b8Vy30Os7VRy07SEySvkF4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772947501, "uuid": "b4569c45-1e85-4e47-9d03-cefdb2388c69", "value": 43852766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772947501, "uuid": "d2a1c435-1156-415c-9050-99c828a37a9a", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772947501, "uuid": "e223bf85-d5f8-4baf-88ff-2fdad32a6fdf", "value": "WOT-Cheat-5.2.2-Win64.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c8b53b5-1b31-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773003531, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773003531, "uuid": "acc6ac2a-611c-44eb-8d8d-3e62555d3879", "comment": "Malware payload (Mirai)", "value": "60d013d2d638f10062357fc9acea08dc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773003531, "uuid": "da2ad38f-a0e5-40f7-804f-1653fabda4c1", "comment": "Malware payload (Mirai)", "value": "4249b03f1000eaea177d71c0435feed2a2fb4dac74d08dde213b940e230d4229", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773003531, "uuid": "542f32c3-496c-42a6-9c64-ac6e803b1fbb", "comment": "Malware payload (Mirai)", "value": "9455aeab8309fc9c1cf0486ef31fc5bb9cb6056a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773003531, "uuid": "f10e79b9-97d6-4710-ba70-c8c61df9ab7f", "comment": "Malware payload (Mirai)", "value": "5f2acc4f966fb963ac0f5ea23726eeb653b78a38dbb0391db305f2d780b429e3b9de0900fc37904b651f26b186cc08a4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773003531, "uuid": "a8ea30a6-7441-4681-b2d6-bad7f5b6d4e0", "value": "T158043AC1AA52FEB3D5C39FB502A7D71005B3E8255B5B8E01F3AEADF04A1A5C8B10975C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773003531, "uuid": "0eee2f4a-06cb-4862-89cd-ea128c0f1a16", "value": "3072:WV8Zmejb5Mbgkedez1W445HyvhyZBiLmJKNZY38IkhLRZa3itU:WVo659z1W55HyZyZ0LmJKNZY38IkhLR+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773003531, "uuid": "90e75165-3648-420e-bd23-aa6c98bf44da", "value": 174977, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773003531, "uuid": "d60f0663-ddc1-4026-a97a-1684fc660d34", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773003531, "uuid": "0de5ed35-22bc-46ea-8cb8-08b135c45703", "value": "x-3.2-.dick", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c29eb545-1b16-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772991999, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772991999, "uuid": "145589f0-b96e-4c4f-ba35-3961605c5d74", "comment": "Malware payload", "value": "fba52bc5fc0e81eae7b7e359b5e38b8a", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772991999, "uuid": "3ce2881d-416a-4cdb-8eb4-df39e9e58e7d", "comment": "Malware payload", "value": "424c9a9f97515dfa3511170263ecdf4bc3cfb8e94ac491d56b4fde4e9d616676", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772991999, "uuid": "cc081a52-1b01-49b2-b1b8-a35d926d10fa", "comment": "Malware payload", "value": "282dcdb2ae1ba9fa19cea0d94c5918398fe50e90", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772991999, "uuid": "54702654-d809-4e18-9bc7-d366030468a1", "comment": "Malware payload", "value": "d13e94674a770ee861dba80efe1bf1d3de29f2b64853705cd7acbc83f82c4f0edfedad78ac7249ab3867623993eed3cd", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772991999, "uuid": "166e6112-db48-40f4-9d40-816900b59137", "value": "T14A925BB916496C79BBC0DE7D9F3C7F0CADE881C02118A3ACBA4F39715A2069DDA0535D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772991999, "uuid": "8ee7c6e2-47e0-4a33-b522-ced8ee799ca4", "value": "384:vv0M3vgRjGlsaq7DzsO9a4cbddrME8jyfzsO9a4cbddrME8jy4:vbmjfXzsP4cbddr7zsP4cbddrk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772991999, "uuid": "5ec58e64-0681-44c6-bfb1-a15e2b307eb9", "value": 19499, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772991999, "uuid": "843a787e-835f-4fe7-b333-9bdb5f4e0375", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772991999, "uuid": "5a0fb47c-4acc-498b-ab0e-2cefe4db3c13", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "112c7529-1abe-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1772953905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953905, "uuid": "3073f413-c83a-46ab-8b9a-bc0e49d06cbe", "comment": "Malware payload (AgentTesla)", "value": "591452a7b7a1047971076e5c93c28dbf", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953905, "uuid": "48f842c6-133d-4955-b780-ed7bdabf14ee", "comment": "Malware payload (AgentTesla)", "value": "45eb73398238e138ae634ec04ce86dbe759a77e40c0fbd0044d420183f2a4159", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953905, "uuid": "1d6fa111-6881-459f-a076-7d7c0ba53ca6", "comment": "Malware payload (AgentTesla)", "value": "1438474df2532fae56327c5373ab949aa52677d7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953905, "uuid": "ca88e89e-6d7d-4725-bd0d-3d8cd6daa627", "comment": "Malware payload (AgentTesla)", "value": "ed8d436dabadc09afe85aaba8ce52b91a770ab9090dbf7789dada3f26feaa3f15dfc1a53bef098443abf01365e8990dd", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772953905, "uuid": "b9d5a26d-ffd0-48a8-9576-be29626c61d1", "value": "T1D545A919523622E7EE83849D77D9E2D9BD12CAAA1513C17C6A304DCDCD0BB8D07394BB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772953905, "uuid": "9a2c52d8-5fd7-4c1e-b6c2-c5883eeaf290", "value": "192:/NJD9DD+50ZEbARzZLJcJRdV+gZvRT+FR2b893PTw/+05675/Qipepg+G+m2ctOU:x68Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772953905, "uuid": "a47d7380-17de-435b-84af-05b7c57fba4e", "value": 1213743, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772953905, "uuid": "74c739bf-b09f-45e4-b602-685b62689a8c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772953905, "uuid": "d4d9309c-0283-4b35-9930-a90dd5aee47b", "value": "591452a7b7a1047971076e5c93c28dbf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "804e9f4e-1b30-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773003055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773003055, "uuid": "bb83a6df-58fb-46b7-aa39-cdbe426a9a81", "comment": "Malware payload (Mirai)", "value": "e9da6b23836d0e30b305ff2fd366a46e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773003055, "uuid": "f780f9e2-1036-47a6-a435-f248ef5c8dd1", "comment": "Malware payload (Mirai)", "value": "467e5d1a944894a003e963f157ac9d11b96125130dae85a1dccc2a34b9fcb863", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773003055, "uuid": "5beb9967-5897-4df0-ae08-f3e3e023666c", "comment": "Malware payload (Mirai)", "value": "1e4e323df1715e4ed51942e6477a8004b870b8bc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773003055, "uuid": "77aa19c2-0ff9-4dc9-b27e-4a6b3359b0d9", "comment": "Malware payload (Mirai)", "value": "cc4eca64e744c7a36942921f099f5f25db7a44f61a1d781fe20e39de76c0fcd03c537e721f2f5c271108eaaec6b5c924", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773003055, "uuid": "eb2c85e4-6380-40f4-810f-5ac45a4fa59c", "value": "T1722418437991BDFBC4C2EFB457EBE11148B3F8351B22620673E9ADA51A0DDD82E0D648", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773003055, "uuid": "fd367387-c995-47b5-ac33-aafca152711e", "value": "6144:5ANM5jgaHWqtDRp1BxmRKN8Yul1VhLrtu3Ztt:5Aq5j91hxmRKN83l1VhLrtu3Ztt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773003055, "uuid": "27cb16ed-3240-4953-8577-e10876711742", "value": 211662, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773003055, "uuid": "70ef4457-1847-45b5-b8f8-5b32d3b9ff9e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773003055, "uuid": "4ddc6053-b455-416e-a800-5893ae92f65b", "value": "x-8.6-.dick", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93b71b91-1b0d-11f1-a769-42010a9c0008", "comment": "Malware payload (njrat)", "timestamp": 1772988055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772988055, "uuid": "22d34382-3c97-41a5-9119-37ae7811f569", "comment": "Malware payload (njrat)", "value": "91a568c57c93e40a0a64f8f727141c88", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772988055, "uuid": "51d6fa99-1469-450a-b843-515e63e94d28", "comment": "Malware payload (njrat)", "value": "46c221d9ad3d2b5c4127ef9b4a4844ea6a9f3ede8c814aca522cff3a4e0f6153", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772988055, "uuid": "6832d854-642c-4ea9-b49f-f5e820c8197b", "comment": "Malware payload (njrat)", "value": "3177ee7fd0015692dc5fea8c06139df11f2a3c6e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772988055, "uuid": "d519f034-02ac-4e16-862a-c6deeba2163b", "comment": "Malware payload (njrat)", "value": "424f7a7fc514c939f7292c65c4f01a106832314415786f8c65e4a23e5093b6d0c8e3537bf428be80d4bc0a0f6800f93f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772988055, "uuid": "8c747560-1592-4727-80a3-2859f0ff44eb", "value": "T133E2F84C73A48A23C67E47B84E70964207F1C15B5526EBAF8EC550DA1EA7BE41E00EF7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772988055, "uuid": "ec4798da-e6ef-4f97-9507-70518944911d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772988055, "uuid": "fec2cd9a-484f-4d10-8cfb-b3554ce9855b", "value": "384:itpw9lRPwz2jSUpInHDzcNIpBKywTDwMGWYccF3BoJzEY+tHVkw3ccNwifGIyLs7:iPw9lRPwzpjbvwTDwMh+Uw3ccrfLJqr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772988055, "uuid": "ea02314f-bf5d-4d4b-b309-97361b23576b", "value": 33280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772988055, "uuid": "f6379bf0-3a7f-40d6-8a5f-c7981969aadc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772988055, "uuid": "681507f0-a7c8-45c6-9e61-aee3167a60e7", "value": "91a568c57c93e40a0a64f8f727141c88.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f31e4aff-1afe-11f1-a769-42010a9c0008", "comment": "Malware payload (RustyStealer)", "timestamp": 1772981772, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772981772, "uuid": "1415d7dc-7a3c-4a49-81bc-ff8f1f4d8796", "comment": "Malware payload (RustyStealer)", "value": "adbc204ab336fd45214e245bde372b69", "object_relation": "md5", "Tag": [ { "name": "Agent_AGen", "colour": "#118452", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Kepavll", "colour": "#0EEA41", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Kepavll!rfn", "colour": "#301EB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772981772, "uuid": "6580ceb2-981f-43d8-8069-b8669cf96bc5", "comment": "Malware payload (RustyStealer)", "value": "46eff9a87b59071fd3193e5cd78fec8145596fd73161bcf6060e3c33b13be403", "object_relation": "sha256", "Tag": [ { "name": "Agent_AGen", "colour": "#118452", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Kepavll", "colour": "#0EEA41", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Kepavll!rfn", "colour": "#301EB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772981772, "uuid": "a53f50c2-e528-4dc5-9792-dac9dfcde70a", "comment": "Malware payload (RustyStealer)", "value": "0f20f11116d70526cad375d03af561c43e01f214", "object_relation": "sha1", "Tag": [ { "name": "Agent_AGen", "colour": "#118452", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Kepavll", "colour": "#0EEA41", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Kepavll!rfn", "colour": "#301EB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772981772, "uuid": "73abbd74-37e8-4f50-a23d-1f7ebb923f39", "comment": "Malware payload (RustyStealer)", "value": "e62f82eac8b2075af818d71d3625047c44ba2a5f085146783fbb07d5718295c29e0d5ae4f29306444b5c2e6c338788d6", "object_relation": "sha3-384", "Tag": [ { "name": "Agent_AGen", "colour": "#118452", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Kepavll", "colour": "#0EEA41", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Kepavll!rfn", "colour": "#301EB6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772981772, "uuid": "9b625cca-c5c8-409f-b2b3-d41c4e2f552b", "value": "T1A1065C03E69581E8C06EC179875BA733EA32B88D0534769F6BE4CB212F55F50AF0E719", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772981772, "uuid": "73d45093-0798-46c4-afa0-e79c4a8eab2e", "value": "89d74b03aaba076f573028e492514138", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772981772, "uuid": "4ba8bc61-cf28-4b28-a612-e66b142e4dc3", "value": "49152:7L66ggI6y47IZhRLxEo7qdC6Lac/ONbWe/VJoZuBL/I/pGS93PstmfzMJs5WkGR1:16hxNd690twwJs5WhMtkKGGGGJGGZ9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772981772, "uuid": "664be113-00e5-49f2-968a-137d36ef436c", "value": 3945984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772981772, "uuid": "e32c6d8d-61ff-4be6-abbd-1a5f5a64c2ec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772981772, "uuid": "6ed8fe16-d70f-4b99-8cc6-ee3a3363bbc5", "value": "windows-x86_64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9330fab-1b30-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773003231, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773003231, "uuid": "4fd62e5c-606e-4f27-bcfa-1f98e14bac12", "comment": "Malware payload (Mirai)", "value": "2eed77ed156a22575aa4a76cca723cd0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773003231, "uuid": "48ee6831-5b88-4e97-bcc5-44d13451b97e", "comment": "Malware payload (Mirai)", "value": "4802cf47b0eb46e7ee6ae7b8bacd203e4117d0c6947214f3dd4bd4d77bf8c0cd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773003231, "uuid": "ee129abb-54c1-4d65-a5a6-a8800ea6f948", "comment": "Malware payload (Mirai)", "value": "66ec2155ca3a7c7bbfc7adead77ca2d15f21c417", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773003231, "uuid": "52da6716-9cb1-496d-9557-d64a390f4fc0", "comment": "Malware payload (Mirai)", "value": "3250a768f45fc22c49e8dea5718ceea5d15eded70b30187012f067437cce870e4a3b17b8cc4f31c8a62fe51dac04b3fc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773003231, "uuid": "b5b983c4-3bcc-4ee4-8b30-9a71577d7183", "value": "T1884495593E22BFBBF1D9C77047B3CA2046D925953BD19785F29CD7181E2028E680F7A8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773003231, "uuid": "788cda46-fc76-412d-a1bb-c6e4766db2cd", "value": "6144:FSqheVLeUlArqBfVQKm+mM5gZNxPeHy2O/6lWI1:F2teUFQ3+mM5gZNxmHy2O/6lWI1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773003231, "uuid": "257bf603-1e41-404d-85eb-a6b907ea6170", "value": 262689, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773003231, "uuid": "53d34a03-4dcc-48ad-a671-87804eb01485", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773003231, "uuid": "464c385c-b9e0-495b-9c82-0086aab2b0ff", "value": "m-i.p-s.dick", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4184c5b-1b0d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772988109, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772988109, "uuid": "ca9a8791-7fab-4f80-8fde-c8b336077429", "comment": "Malware payload", "value": "81728445de0215365e8736e23902db92", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772988109, "uuid": "91f1ce50-ab41-435c-ad6a-af302eda0b7f", "comment": "Malware payload", "value": "497369062516b4e8d50e880adadd1cda7a796e5b9d27fc3e58ad2bdba70769af", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772988109, "uuid": "6ed3ad9b-3944-44a7-9fb6-2acc7d625f75", "comment": "Malware payload", "value": "7d240933a66fa87d16016344a222c141445fde7d", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772988109, "uuid": "6d43cd29-e4bd-422d-b207-058b348889fc", "comment": "Malware payload", "value": "e8270aa02bc9a9fa3c89999b69a7bae0583f599b1631aec0a2ce67acb88cfb2b087f5f79ce8eb3cb57e96bc1644c3cbf", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772988109, "uuid": "212641ab-4595-49f6-804c-2fdb8a88bd70", "value": "T1C14121171AEA0229F2F6DA3218776B21B972F882AA159C2D00D0010D2C13A00ED26F3F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772988109, "uuid": "6bdf0121-9b96-4aa2-9ba8-205ddf77e751", "value": "24:8BoJyl5+IeeXZYyDglco5ZiebqbFlqddNXuHY8EHGFGyCabt7im:8hTJzDg2a4eoFgdLXuH4HGFGfap7i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772988109, "uuid": "2929c7fe-5731-4a06-8b5a-33948d7b71ae", "value": 1990, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772988109, "uuid": "794b9437-517c-45b3-b3ad-93ea92baaf76", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772988109, "uuid": "df2e0be8-cdd0-4050-9588-9f653dfb6043", "value": "NotaFiscal-Fev2026-NF38291.pdf.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf7d3d4f-1b0c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772987725, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772987725, "uuid": "322e7bfc-17e9-4816-801f-037b3e40c041", "comment": "Malware payload", "value": "e993e083d7234de7b9a450cd3ab7d36c", "object_relation": "md5", "Tag": [ { "name": "pw-valorant_git", "colour": "#39E407", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772987725, "uuid": "ae1dc0dd-95b2-49bf-be30-2d631823f552", "comment": "Malware payload", "value": "4b3e2b8ff7956fc9a4dd54acc9ba22060544d6d7c8f3e606f4d34daa7e04fc09", "object_relation": "sha256", "Tag": [ { "name": "pw-valorant_git", "colour": "#39E407", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772987725, "uuid": "5ba23e56-d81b-4f58-a95c-1c4648dc9e4c", "comment": "Malware payload", "value": "2ce5b354ceece4a1a23144a848ad39e15c206dbd", "object_relation": "sha1", "Tag": [ { "name": "pw-valorant_git", "colour": "#39E407", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772987725, "uuid": "2d79d575-81eb-4d5e-97f5-1cdedac755f5", "comment": "Malware payload", "value": "81d2f65ccce9fc7d3907b8df0be68391d22d24cb78ed80edd68e3b83191f458f832a0ff6e5877b846efd0975ed39e5ad", "object_relation": "sha3-384", "Tag": [ { "name": "pw-valorant_git", "colour": "#39E407", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772987725, "uuid": "593d6baa-2163-4c23-8bc1-4f9d74e19672", "value": "T1439733F2E874FC3E8AB799C294FB08C5FEF9216841E0E55A64D58C0F3842876DEC5991", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772987725, "uuid": "166b42e6-731b-4743-9a61-ef824b0e18d1", "value": "786432:ITNAKXcefHxb7bq0m5+g+2uLrfzaD318jTQM3gYglUjV:IpAKXcOFbq0m5+GOfwl8jgYlV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772987725, "uuid": "bda34e6c-5c6f-434c-87e1-91d6d01f3ee7", "value": 43050030, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772987725, "uuid": "07e05aea-04b2-4e77-994b-6472688b73ef", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772987725, "uuid": "5ff2a2fb-7332-4fc8-81a7-f60d3e73617c", "value": "ValorantExternal-3.0-x64.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f427ee2-1ae3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772969874, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772969874, "uuid": "d5d1c390-bfde-4eda-9955-b6bfb3fc09d0", "comment": "Malware payload", "value": "30af1aea19ce3c21c34908a52d070a3d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772969874, "uuid": "693264ca-bfa2-4540-baf9-cf90f28308f0", "comment": "Malware payload", "value": "4bb1a9591d047673fb0fbad3d7c41c2d55fbaeaeab26a61a205d278204316f7b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772969874, "uuid": "f3325ebb-7636-4c4b-9753-f3bb4114d580", "comment": "Malware payload", "value": "5c60bb2f6a68e1e00a4deddce95ca22ac3e0ab38", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772969874, "uuid": "d9026d77-4b2a-41b5-8461-dd2776387795", "comment": "Malware payload", "value": "73226a278a4ffe69f93141f4cb3cf81c6eb21388e2cae91df58be4f5b079f998dcf927646197bd269e03fd9e6a76516e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772969874, "uuid": "6d1a7348-b906-476f-b471-7efe186440e5", "value": "T1E4F7333BF24B602AE49E12726472D3201C3F6D71A81B8C5982E4F95CDF751B06E3EB95", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772969874, "uuid": "ecae27b3-4f86-47cc-a2b9-1c541b5ae878", "value": "88016fcdef7f227c62171d0afad9aae4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772969874, "uuid": "5db2c82f-a018-4488-a7df-4c129bc1f4ee", "value": "1572864:+e/L9YwlXiWAeTxs+THYVpzXRmiKojfeyicmmqw+Ysi+yUgxEhMFmmyY9Id+p:JjWw1JTOpz6ojbiDRtJi+yUgksOY9g+p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772969874, "uuid": "1d87ce14-3d38-4a4a-9502-63973a984a2c", "value": 76581360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772969874, "uuid": "a3e728fa-fc97-42cc-a80e-38ede47396fb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772969874, "uuid": "2d8f2d9e-3ba0-4687-a767-002b81d349fb", "value": "4bb1a9591d047673fb0fbad3d7c41c2d55fbaeaeab26a61a205d278204316f7b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38c12474-1abe-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772953972, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953972, "uuid": "ece857ba-f49a-4139-bf08-9ce8656fb1e2", "comment": "Malware payload", "value": "a10650b49ac34a2f39d91b9f1022e2c0", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953972, "uuid": "8384dec8-33bc-4df6-a2d8-892abecef2ca", "comment": "Malware payload", "value": "4c36594c89541fc3e35b5acb3f789baed025402519a99af868e35d49c26193cd", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953972, "uuid": "20bfa1c9-9d10-4d56-8b63-75c72ecb3794", "comment": "Malware payload", "value": "8b4ce72f30ae9e361e79393215b16d16b42f7f8f", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953972, "uuid": "939beeb6-34a2-4efe-850e-044bd9ea338e", "comment": "Malware payload", "value": "8244d275c6c228629b5d100b767ed6b7e9c66c26d462171a84e03f36211e168ee4b35e60f9e76326bdbb79466999fd1b", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772953972, "uuid": "7fc75b74-b659-4636-8c81-54dc01336a97", "value": "T112C4DBDD2EC2F25D0F82A933F21AF06DE4F588F0536A4C2AA0DC2C48EC656D5ED55639", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772953972, "uuid": "80392f65-b50e-4e3a-a6e9-a735fdd9eac4", "value": "6144:IuYNFpvahJ70nn2bzvMycWZUXJmSos7wT+ldrWLpzpqaWEml:cNFpcZ0nnIhJZUXJTos7wqldrIBpqaWx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772953972, "uuid": "96d29d28-399d-4ebe-9300-609189d0896a", "value": 548003, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772953972, "uuid": "3b0d3e91-f2d2-4c57-9f30-c936066fd370", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772953972, "uuid": "bb6b4dee-857a-4776-8f78-5a777a0d3666", "value": "a10650b49ac34a2f39d91b9f1022e2c0.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ad15e41-1b15-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772991288, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772991288, "uuid": "37d6bb98-e1c4-42eb-804c-a91eb7607daf", "comment": "Malware payload (Mirai)", "value": "2763ae669730bcb5db0b2b4e5173d4c3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772991288, "uuid": "d16066a0-d2f8-41db-8c95-27453f8e08c1", "comment": "Malware payload (Mirai)", "value": "4e0397bca64a379fe67755773f7e85418bc038d5a96770ca2bf5288ec5dae9c6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772991288, "uuid": "edc11407-452c-4ba3-9594-97ad3bb76960", "comment": "Malware payload (Mirai)", "value": "ffb44b82a1462b30cfd7293eb0ed9dfc3b403566", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772991288, "uuid": "b399dee5-7997-4378-982c-69118d171a81", "comment": "Malware payload (Mirai)", "value": "ebc2bd077603d222f553f39a40392af551df303d90e403045694fd73af08535a890b3d8f2fe8d9495810c8cddc61b564", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772991288, "uuid": "7c815006-c734-4367-8afe-9b23664332c3", "value": "T131042945EA404B13C0D627B9F6DF42453333AB94D7EB73069528ABB43F8679E4F22A05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772991288, "uuid": "0b3d49a8-09f5-4443-b978-d6af61289771", "value": "3072:OLe6vhfZQIvuCeeuaMuTuRez43IVILLZQy38YhTfYo+M/RgDlplLn:ee6vheIv1ruaMuTuReErLL738+x+M/Ro", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772991288, "uuid": "2e691f9e-30ed-4af2-b141-b98c122879c1", "value": 181474, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772991288, "uuid": "bf56dc16-8eb3-43f3-9627-263f04cb4fdb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772991288, "uuid": "b3ec8099-413c-4db5-b05c-ed106d0d252d", "value": "main_arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aee5d549-1b0d-11f1-a769-42010a9c0008", "comment": "Malware payload (SliverFox)", "timestamp": 1772988100, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772988100, "uuid": "2c198c78-0303-49b6-868a-74c4b44e6690", "comment": "Malware payload (SliverFox)", "value": "08327b013590804251898cc22f44713c", "object_relation": "md5", "Tag": [ { "name": "Egairtigado", "colour": "#3EC4ED", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "SliverFox", "colour": "#76DC89", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772988100, "uuid": "1127e499-65b7-45b3-9abf-3cbe70c98b21", "comment": "Malware payload (SliverFox)", "value": "4e49cd78fd8b349153fc03b35134edc52df22bce6fb24608fd9d6be9d805b5e3", "object_relation": "sha256", "Tag": [ { "name": "Egairtigado", "colour": "#3EC4ED", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "SliverFox", "colour": "#76DC89", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772988100, "uuid": "d71b3f99-b301-4179-a970-806bb9371dcc", "comment": "Malware payload (SliverFox)", "value": "efc8207db08d63c5da44462498c322cd3452154a", "object_relation": "sha1", "Tag": [ { "name": "Egairtigado", "colour": "#3EC4ED", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "SliverFox", "colour": "#76DC89", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772988100, "uuid": "6147fdfa-1757-4d5e-a4f6-113d0159fe8f", "comment": "Malware payload (SliverFox)", "value": "a8e5996c8f9760829cc97b333a01a1c803f450cdf85aa3d400b5b06851c5f375c8c23d606441f6a321e9b5098de3e147", "object_relation": "sha3-384", "Tag": [ { "name": "Egairtigado", "colour": "#3EC4ED", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "SliverFox", "colour": "#76DC89", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772988100, "uuid": "1890ac1c-ecd4-4a73-80fe-63f581d44213", "value": "T144F4AD0CFC9C8F50D29B05B5A32218D2F66D7A18673183337BE12A943C5D7A9969B7C3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772988100, "uuid": "59546c2c-0f1d-4099-82f1-dfc867c5617c", "value": "fd8f2c88fa4436ebefce520cbe5d1799", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772988100, "uuid": "ab941b7e-eeb9-4cf9-b163-11caf29b30e9", "value": "12288:HEX8J9k7Unxqq+mM2ZkvxPt9RSx7dPSl0nKMRWMm:HA8/r+Cm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772988100, "uuid": "544d7b2a-8729-462c-82e5-e326f19e33d0", "value": 760320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772988100, "uuid": "b2aba24e-a28c-4d8a-acd4-7a606a8877f6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772988100, "uuid": "78cbfbce-38c0-4915-9082-4a05018ff9dd", "value": "2026\u5e7401.16\u540d\u5355.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd02902b-1b32-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773004042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773004042, "uuid": "bc0e9593-d8c5-43ec-9d73-66bf4b425200", "comment": "Malware payload (Mirai)", "value": "88450a0aa8310519fefebb997b9b9cdf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773004042, "uuid": "84c70c90-00f2-4e82-842c-fb93df38e725", "comment": "Malware payload (Mirai)", "value": "4efee5a4791d5b66cc1cbe04e5e7121001026b4b7ba94975fe1031902302ecb9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773004042, "uuid": "a0c1875b-0e6e-4022-bcb1-4b34399c1d44", "comment": "Malware payload (Mirai)", "value": "cd86c054ae93c3ec2a9ce47b962104ea3ac15018", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773004042, "uuid": "29ef0ec5-8e8f-4bb8-b7a1-124bd83e2aae", "comment": "Malware payload (Mirai)", "value": "801bf4c18dd774681f7aaac2114d068c26079c14e4fcfdecbfa1dda20607b03e458a72365e27dfb01ea30848bc090d12", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773004042, "uuid": "182a9473-9aaf-41af-96d0-92315a638ca7", "value": "T1B2932951FC829613C6D512BBFA6E428D3B2613E8D2EA7203DD215F2077C785B0D7BA85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773004042, "uuid": "62eb72ec-5962-4bc4-a89f-9dd4057c2c50", "value": "1536:0s4pE2pQvF2zBQjD10ZVHxk6lMawZDouRMpqOlY8OXYjvkDDK9fvRU:p4pE2/UyZViIMaorRMpZpcqRU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773004042, "uuid": "97f9a276-61d7-48d0-99fa-40259d544871", "value": 95824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773004042, "uuid": "a6b5cb10-7c79-4029-b83a-53f575dc95cc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773004042, "uuid": "c5f5b213-5ab2-41fb-9941-b49f67f303ee", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "faf45a3f-1b31-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773003690, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773003690, "uuid": "e3860dde-ed60-480b-aad6-5572fa669fda", "comment": "Malware payload (Mirai)", "value": "5836b762a280a2bf3f7a17f6159c8724", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773003690, "uuid": "d635a1ae-2b45-4219-8195-ff005a0f1060", "comment": "Malware payload (Mirai)", "value": "4f56e4cd0110b4a115c6ca02bc2b280d94a2a46d08b45928164015ffd942dd55", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773003690, "uuid": "225f6573-e761-4fa2-b147-9ecdf2cb652b", "comment": "Malware payload (Mirai)", "value": "4a10bbd1f0e02aafba5389a213e66d9c1c2a1b6b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773003690, "uuid": "a5fbf540-9fe5-43b5-95c0-b337f18a867d", "comment": "Malware payload (Mirai)", "value": "2059610fe84c62db44502d08e9c04434d59ef60aab445a8aacc3a4edd758408b4ae6f9e50c97a461d42a24315e9e65eb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773003690, "uuid": "43018cae-b612-4eec-b975-1d55f8c3d52e", "value": "T187B3C91E6E219FBDF769823047F74E25A75833C627E1D545E1ACD2102F6028E641FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773003690, "uuid": "0613c363-6b63-4caf-97a8-dec405f3c3cb", "value": "1536:LaMgKh1hh5WOGgI7qX6vXx3RlKrFZZV8UhXgswi9rcUe2hb7Arip+:vlh8O0KrFV8UhX19rcmMrip+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773003690, "uuid": "354d2074-0ea9-4847-abb7-c71805687455", "value": 118176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773003690, "uuid": "868ac53a-a471-42d5-a941-183c3acfc973", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773003690, "uuid": "0b7eacc4-21d0-4ab0-b9af-d80d91dde40b", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee73a14b-1b29-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773000233, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773000233, "uuid": "f3a2c429-3e71-4692-865d-a09b2c56df6f", "comment": "Malware payload (Mirai)", "value": "71f89331c6f7feac513ced805132c8b9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773000233, "uuid": "5bcf9743-a7f1-4c5c-8beb-0bb7adff2bd9", "comment": "Malware payload (Mirai)", "value": "504a0ac63d398263a2635ad88b90a01d49cd49391ad6d9a2917c86e961f3a404", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773000233, "uuid": "f509d14a-5590-4b23-995a-ac3380ecdf5a", "comment": "Malware payload (Mirai)", "value": "b2720e4b46ef2c36b31890ab8eeda41c8eb85942", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773000233, "uuid": "4e09f44f-89ee-419a-a66d-a1a4673c36a1", "comment": "Malware payload (Mirai)", "value": "e0bfd1cbb91b4575005fc16db80c30fae186e73791b68ac1290a8afd593d35070ebd7cb92e96dcf8c89f73a30510e4ce", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773000233, "uuid": "2747fbdb-14e1-43e8-9bbd-772fa419dec2", "value": "T1E414781A6F228F6EF269877047F74D249B5873DA26E1D680E1ACD5501F203CE641FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773000233, "uuid": "b91d4b5c-a502-4950-b4a5-2645d735cb6a", "value": "3072:rTZXmc+CI/XHYjDUAGhAgTEB9jy6MRYorL:5mjCI/XCwBEfybRYorL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773000233, "uuid": "8bf632ad-b751-46ce-bfd4-b4e4f99a7196", "value": 190724, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773000233, "uuid": "9560426a-3613-4400-bad6-3a65dbaa8e50", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773000233, "uuid": "935b7189-cb94-44bf-b540-e508818be996", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bffdb1d-1abe-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1772953924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953924, "uuid": "fb77eeeb-c57a-4ff3-a1cb-a9302016a99b", "comment": "Malware payload (PhantomStealer)", "value": "ac3f9b5eb647d9ca7f7ae0517a76cff0", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953924, "uuid": "71dbcbf3-4230-4449-b27e-6cbdae63e1fa", "comment": "Malware payload (PhantomStealer)", "value": "50d32b053ce9cc693551364cdca6e3b453205f496ef6aecd1de39577ff73745c", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953924, "uuid": "55eb4bf0-f1ad-4d74-9afb-d8158a73e210", "comment": "Malware payload (PhantomStealer)", "value": "3c14469eec4642a8f67a99169aa55febb6dfcda2", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953924, "uuid": "ed5d7c56-05ec-4367-a4e0-1d7aa52725c5", "comment": "Malware payload (PhantomStealer)", "value": "545c39b273e31e54fa3629c476e39c26403313b94474fa721c4e2defbf807731b75830739c6b9a7d6bfb4e9f6d57084b", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772953924, "uuid": "5c1c59fe-0dca-4ad7-8ac1-6f71d12af89f", "value": "T17026AF00A8C9270CAEF5F60DF478DB4516B09D1BC156A06E87076E8DDF5FE0AB29F846", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772953924, "uuid": "d5861088-88b2-4f21-9da6-8f3b94d0272e", "value": "49152:HBisB6zJAagbhsplno9oT5z6+LEr21ET3+fTJNEbHO+S4ssV5arH:o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772953924, "uuid": "04193f9d-1366-4e04-b642-648a504b4c7f", "value": 4714228, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772953924, "uuid": "10dfb97d-c324-4b58-b2e5-3b7192531361", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772953924, "uuid": "021eb6ba-b6e8-46d3-99db-fbb5088b34c7", "value": "ac3f9b5eb647d9ca7f7ae0517a76cff0.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50f4a0aa-1b02-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1772983218, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772983218, "uuid": "68e981b2-5148-4ef0-80d0-01560c8c8a42", "comment": "Malware payload (ValleyRAT)", "value": "85adb7284c96b5af11fd524c3d76118a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772983218, "uuid": "aa0115df-5a5a-453c-adce-470c6def8373", "comment": "Malware payload (ValleyRAT)", "value": "510cb9281e7ee38b03d7ac08ad2d8f93bebe37f96adc886236125f67242f83bd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772983218, "uuid": "9ab016d8-0c21-4f9d-81ca-57ec9167e8fa", "comment": "Malware payload (ValleyRAT)", "value": "9083cada0fa5dffcbe3736e805f800bc0bded979", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772983218, "uuid": "e590a5a7-2b16-4c3c-972a-463860413839", "comment": "Malware payload (ValleyRAT)", "value": "7df91aba5b0dd6ec282ed068a437ad2557f9b1402405c81e9ac4c3638bde6a56a93284bf50f1ac3886e04966d09de8a3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772983218, "uuid": "9a7852a4-7a05-40cd-b78c-68cf430e8f08", "value": "T1AFE53313E7C74471E8280578C97BD4584D633A201CF2987A6CBED86F4E74AD21CBA7B9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772983218, "uuid": "2760ef60-8df7-4557-b753-078c22eb6f78", "value": "483f0c4259a9148c34961abbda6146c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772983218, "uuid": "a46523f6-4e76-48d5-aa1b-c311f8d4fecc", "value": "49152:8hyXLqUB0r7CxYb0Oj/Z9d6kJ4JCGWc9YRBU+89uB6stWfxWnG8EMSapbxBs+C0m:8wXHB0UGEk6JCGWczQ6yOWnG8rS0bzsb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772983218, "uuid": "b1f539a7-3673-48e2-8e5c-8f2adb86e86d", "value": 3281399, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772983218, "uuid": "ff3c9f8e-a9bc-4328-a301-f7e01558b07c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772983218, "uuid": "e8849fca-332b-48db-997d-899bfe251de3", "value": "ShutiaFai6.22.5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2f398d0-1b37-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773006119, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773006119, "uuid": "c20005f7-41f5-4404-903c-8d822b6952fa", "comment": "Malware payload (Mirai)", "value": "4be65043a83a54ae81c5b9150239d61c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773006119, "uuid": "811349d6-ec61-45d6-ac3d-746d27f8c4b1", "comment": "Malware payload (Mirai)", "value": "52ea022f3c0682f72a8bab928c53c718e8506601ce3a24c7dc2db38acac3b325", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773006119, "uuid": "49899397-3a4e-4c02-8489-0f2d7c345f69", "comment": "Malware payload (Mirai)", "value": "e7852f10fcca76030dbab3dfb121061951a84c8f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773006119, "uuid": "3888cef9-f79b-4eb0-83ed-dcf4f7515b02", "comment": "Malware payload (Mirai)", "value": "1539e947f5d1af37589978858f99db6dbda107b631576687cc56d390d9a12221c37d22f8755bfce831c75852b263b98a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773006119, "uuid": "321bb4a6-207a-4676-bce6-b618c1282b7a", "value": "T156A33AE6F401CE7EF80ED77B44530A0AB531A3E106831B376397B963ED721955863E82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773006119, "uuid": "0a44a70d-1e6f-4bdf-b563-b72b8b9b69f7", "value": "3072:uvAIKq6y748jBNVwy7y/PjnaGA0KC9XsqY09Xhl:tq6yVwy7aPjnbX9e09Xhl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773006119, "uuid": "31174dc9-d5fe-486d-b621-5dd3b431fd45", "value": 100840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773006119, "uuid": "99bc1602-fd71-4b04-bbdd-007d838bf825", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773006119, "uuid": "965c9022-2047-4c83-8ee1-bbe963347071", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70b269d4-1b11-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772989714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772989714, "uuid": "4f4e32c8-50dc-4a01-8775-6bd888a56ef2", "comment": "Malware payload (Mirai)", "value": "59a50624700b9c71337cb28422a94a7d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772989714, "uuid": "3b3e675a-1b15-412c-8d9f-3fa71480a4de", "comment": "Malware payload (Mirai)", "value": "5475c2a16270d8015c82bb85eca66b159d6ba4fa256252560e6b6bad665e4c26", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772989714, "uuid": "db78d920-cfa7-4d6f-a526-4422a141567f", "comment": "Malware payload (Mirai)", "value": "268ff824dcd7c8ad26c4bd40cdc008a22472b221", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772989714, "uuid": "47ef016c-e1c8-45a0-80ff-f91cd7900822", "comment": "Malware payload (Mirai)", "value": "f9ea8195eeaf78101892d0f0f5838562bfc5df0f5d9b97a19417fe97cda56e674fdac7889a053271d32d3cd9e9b6d7d0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772989714, "uuid": "cfd47b76-c10d-4b7e-bbbd-cf2fb11ebeeb", "value": "T121F54962B892DE93C6C05675BB5DC2EC7B175B34D2EE3206CD0443283BBB96B097B152", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772989714, "uuid": "46dca352-0ee7-4540-8b0b-9c7b05d3f3ff", "value": "49152:ZVzckb/JVlc3QTCtZLZRWSeFfuz56r+evWCQPd:ZpnhVlc3dPRvf6bWCg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772989714, "uuid": "79207b0d-7f87-4f87-8f40-a0880f18d60e", "value": 3545444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772989714, "uuid": "ebe44393-ba6a-435a-8393-16f3fe46f8b6", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772989714, "uuid": "c65fd2b7-4ed7-4805-95e1-60dba3908a21", "value": "armv6-linux-musleabi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7edff91a-1ae0-11f1-a769-42010a9c0008", "comment": "Malware payload (LummaStealer)", "timestamp": 1772968692, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772968692, "uuid": "e17195f5-7f4e-4720-a7cc-750c900feef6", "comment": "Malware payload (LummaStealer)", "value": "674b2b95cf07fcf84004723e069ec827", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772968692, "uuid": "07ddccaa-8b07-4fc2-b0eb-664536413649", "comment": "Malware payload (LummaStealer)", "value": "54eee378bc2e454bbf174cf3b93d7697964d0ea688d6e2441697b6cd3a2871af", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772968692, "uuid": "b47e3d70-bfc8-46b0-b7e7-0a892c7e7253", "comment": "Malware payload (LummaStealer)", "value": "29daaaaf58a263d6e2284cc6e08aaeb3748996ad", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772968692, "uuid": "31635579-2ab0-4da6-ade1-80b2df648847", "comment": "Malware payload (LummaStealer)", "value": "8e65fd185b8e450080285fe36507729b3c4ecc1854e2393560cd0acb43b68bae4ef51ad7b68249000047cb1b345f92d1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772968692, "uuid": "772a0df6-faf5-4585-828e-42c1a1d596a7", "value": "T13FA4BF11B9D2C0F2D823253101E5E7769E3CB931C9718DCBFBD41D78AA3A390A75A25E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772968692, "uuid": "b23524b0-6c9b-4778-9577-c044d1ab0662", "value": "f6f05543bfd8242a24ed7d1738a5cdb5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772968692, "uuid": "ef48e78d-e6e5-4863-8c24-71f36e1f9ce0", "value": "12288:ssAA+RVy+MBlSPyJVuoBa8YyANOV5qp1/0i:s7Auy/Bl6gVJa8fJV5Ax", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772968692, "uuid": "fe1e0e93-605c-4d18-a443-ec36ee093ee8", "value": 486400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772968692, "uuid": "1eedb32d-9050-472b-b3e5-78649b7e5bfa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772968692, "uuid": "4f50b38a-af2d-4ebe-8dda-c55a24f32e1a", "value": "54eee378bc2e454bbf174cf3b93d7697964d0ea688d6e2441697b6cd3a2871af.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4522b70f-1b2d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773001667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773001667, "uuid": "f74e3357-376d-41cc-9096-b693df732eb2", "comment": "Malware payload (Mirai)", "value": "fe28a110d6f259100c09ff330138eeb7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773001667, "uuid": "cbc8d3fb-dfa5-46fa-bac9-7505fe365703", "comment": "Malware payload (Mirai)", "value": "555c6873fd4ee4310956cba3f513ba181df32462adc599f4dcff04d5e5376225", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773001667, "uuid": "cb7e6563-4307-4276-a8eb-94bdf8b0935b", "comment": "Malware payload (Mirai)", "value": "53490ddd400e7f8d76264e7c7307c6444460051b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773001667, "uuid": "34e84ca0-be65-413c-84a5-bf49685aeeb2", "comment": "Malware payload (Mirai)", "value": "19e36327095fa3955b93bcaafe05d8c6e06bb8e12226ccf654c74b4d38c71e54b71f6c4a15f86f0c47670f6a8fb65dda", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773001667, "uuid": "24731571-07da-483f-a44d-bc0f71a5e0aa", "value": "T16323F1203A21AA55C1706D76CA5248C77B171FFDFCE66437A147AE1C3681C0A3EBE786", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773001667, "uuid": "8e6822e5-c079-4168-a501-0a91de5c38fe", "value": "768:2R8p8/4D6MYLtX9k3Mtf6I9Mn8sI/pfWRPQokyA517dtFKcCNTbyNQHzYgG4XRuY:zp8hDtX9wM56IxsI/agT79pqbyNQs+ZF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773001667, "uuid": "e7cd667a-895f-42a8-9a0c-f05c5aaac082", "value": 46120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773001667, "uuid": "8306329f-1a3f-4a6f-a40c-3d55e9bf3335", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773001667, "uuid": "6bfe13d0-01e5-46d8-9701-58e6c04d6fc6", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0dc60350-1b31-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773003292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773003292, "uuid": "359750f8-28b8-4b86-ad38-ba97b4e5f191", "comment": "Malware payload", "value": "4fdcd9fc0d5e42774b4252c7a0d07cf3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773003292, "uuid": "432fdb52-97fa-49d8-93df-369e17941a18", "comment": "Malware payload", "value": "55c96a098845412f2baea171b4cc28674e92faacd72f1ae4d1cee34554f1b601", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773003292, "uuid": "086f3c8f-8acb-42e7-b0bb-c872edc11eb3", "comment": "Malware payload", "value": "964eb4f7c9d0a12ef9a58f00ce3898f5fe2b36f0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773003292, "uuid": "afaa77f1-246c-49fd-99e2-e7e8582a77f9", "comment": "Malware payload", "value": "2f9de215a94967824dea100abcb4ff7e275cb2586ca4f4a03d3d10369e44ca578f4ffccadd02dbcb3288c701466a1ebe", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773003292, "uuid": "d339e167-f82d-42d7-a0b8-ca3abdefe253", "value": "T1C814F981B9117F73C1C2ABB6F7DFC2553B736A1497DB3301AA68AEB01F4668D0D29141", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773003292, "uuid": "bd9f2aef-1698-4403-8d1f-c3968105e14c", "value": "6144:lYsJSW7o4FATLACx6I5ezFhZUmK0NaY0ZZtsP+VRPd0q+:lYs7o4FmsC0IshZUmK0NalZrsP+VRPdC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773003292, "uuid": "706d4040-d6d3-435c-a2a8-9820ae780fd8", "value": 204443, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773003292, "uuid": "ab7984a1-00f6-4b05-a298-14f81b584ac2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773003292, "uuid": "6a5855b5-d4a4-4cf7-adb9-8b6e163edca1", "value": "a-r.m-5.dick", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0dc03cc2-1abe-11f1-a769-42010a9c0008", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1772953900, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953900, "uuid": "2574ff2c-0d52-453c-bc95-973894d91c83", "comment": "Malware payload (VIPKeylogger)", "value": "7617a7222e27c0e9987539bce6189ee2", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953900, "uuid": "f5dcb5c8-6934-45d2-ab87-ee78cfefc0ae", "comment": "Malware payload (VIPKeylogger)", "value": "594315c7d4803040c6eb2c34e37e86b74458953be7a19b172fea821253ad4ad5", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953900, "uuid": "e9fc5caf-d7d8-4bf5-bddf-ccb3055e9a26", "comment": "Malware payload (VIPKeylogger)", "value": "cac876f130f638d7d4ef4c40f875de6a009a0b31", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953900, "uuid": "b3fe71e2-fdf1-4a5b-aa53-2c0a1b205950", "comment": "Malware payload (VIPKeylogger)", "value": "e1c8d42ea5a0ee3cca6c565e3c2b08731c838154f4d3acd4ae0b6d37daf2ef18e8db6f3b50322e4745256cd7a0c95b64", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772953900, "uuid": "ca0de3df-2a54-4a18-8783-15918488dfb3", "value": "T18735ACAD7AEA9EF0FDE03404D11814E8AD7EC40399C76EAE751B43E7C6529685B036F0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772953900, "uuid": "f87fb019-92d2-4d55-b55a-4109e0803065", "value": "768:Xmot/S/mo4/M/mo5o4o9o5/D/mM6D2M6M/oSM/McM//mM/McM//mM/McM//6M/MZ:k5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772953900, "uuid": "d93634f3-58b8-4e96-8fb6-8e49347ce919", "value": 1114937, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772953900, "uuid": "b27e8580-470a-4142-a619-3d93776a9336", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772953900, "uuid": "b8d2ada8-e0f5-4642-8aaf-0bc18b8bc362", "value": "7617a7222e27c0e9987539bce6189ee2.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c54e33a-1b36-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773005517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773005517, "uuid": "12ff8cdf-0123-47c5-894b-8680aedbf9bf", "comment": "Malware payload (Mirai)", "value": "84590fb4652f98de79f71a8914b453ac", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773005517, "uuid": "a7c2f747-d0f3-40bf-854d-565b542b6f1d", "comment": "Malware payload (Mirai)", "value": "5b57178a6fdafb3a279a0e09e0ff2d728d69299745e2b4e0a9fc1c85d24c63e3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773005517, "uuid": "39a11358-7614-4866-835c-22cd7e22ec15", "comment": "Malware payload (Mirai)", "value": "f13afd8d668163c9027dbee89f24931818d52d68", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773005517, "uuid": "d62c2eec-2eb7-44aa-8786-301158da9f0b", "comment": "Malware payload (Mirai)", "value": "06a2a8ddcfa7523f557b3108780ff8b296d23a0ac5bcd9b8bdaf406bd1b1cdbee394024cd39c22d8cb7ec4b4601df00c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773005517, "uuid": "08c58b00-3280-48fc-8cea-a2342fe1445e", "value": "T16B243A42A551BE73C1C25B79BBABC25537732B64D3D73302AA28AFB01F066DE0E2D115", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773005517, "uuid": "f9f497c5-7d81-4fd2-a5a8-c665339c67ff", "value": "6144:sRA50saXuFUaYSgQhR/gC7JESrOJrmW36iuZYmpjfpUj:sa50/XuUaYqD/gkGJrmW36iummpjfpUj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773005517, "uuid": "d656188b-f96f-43f7-8392-7bc6af2fac70", "value": 227375, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773005517, "uuid": "5ebb325c-f8d1-43ad-9e32-05a377f78286", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773005517, "uuid": "87a07ff0-d8c6-4f5f-9748-2bcfefdbad53", "value": "a-r.m-6.dick", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1ae63f4-1b37-11f1-a769-42010a9c0008", "comment": "Malware payload (ArcaneStealer)", "timestamp": 1773006198, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773006198, "uuid": "2e254699-0861-4a33-9c24-9e6c90144933", "comment": "Malware payload (ArcaneStealer)", "value": "cc15bb0222d474fe93ce23fe16d9a3de", "object_relation": "md5", "Tag": [ { "name": "ArcaneStealer", "colour": "#884033", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773006198, "uuid": "6514fa90-a176-4005-bf70-1d43ed5a1248", "comment": "Malware payload (ArcaneStealer)", "value": "5c99b31028e87c08e584ee1df39fab24b3c8abb203829c946f1bef61c6eaa7d0", "object_relation": "sha256", "Tag": [ { "name": "ArcaneStealer", "colour": "#884033", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773006198, "uuid": "6dd62cf7-e001-4bcd-b078-c4142b4990a1", "comment": "Malware payload (ArcaneStealer)", "value": "1ed315211ac37496e659bbfe7ab9abd579f1071b", "object_relation": "sha1", "Tag": [ { "name": "ArcaneStealer", "colour": "#884033", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773006198, "uuid": "9d8810eb-ea7e-4d93-8ba3-6f15bbaae36a", "comment": "Malware payload (ArcaneStealer)", "value": "9b5df8917ebd7ca3617cc086a524dcb79d73e818c52bc272514891e37f74676c14cef3f11b30cbb693a9e7ae98bd8f6c", "object_relation": "sha3-384", "Tag": [ { "name": "ArcaneStealer", "colour": "#884033", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773006198, "uuid": "2a1f4552-6205-4475-9d45-2b5fb591c006", "value": "T1AD245B0B968525ECDCB6C0391BAB9273F5327C41A724F4DB0B502E195937FC1BA7AB81", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773006198, "uuid": "4890104e-e634-4c95-bbc2-32f78c78ba44", "value": "f564512d7f4ceb3f7e2663f98831e80a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773006198, "uuid": "7386c3b4-a3b4-4caa-aae9-7a871d741a68", "value": "6144:OmLBTiAjXXxGpnaVXfZ3ZsNdEtGZt/h8:OmLBTv8pnaVvZaNdEYh8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773006198, "uuid": "09486d1d-0759-4ffd-b191-0b0cc192fa5a", "value": 228352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773006198, "uuid": "7f693c0e-a207-4af5-9a73-4564ef92cf93", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773006198, "uuid": "fdf22361-c2e9-446b-9b1f-2a5f275054a9", "value": "RaketaFix.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74caf001-1b11-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772989721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772989721, "uuid": "142ac7bf-56e5-4333-af92-61dc9436f39c", "comment": "Malware payload (Mirai)", "value": "22761cdc729e4a7e370fd03fda921629", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772989721, "uuid": "935607af-0240-4c58-be01-73c0f4a440e3", "comment": "Malware payload (Mirai)", "value": "5ce423b43a9be80fe4de96de2a944438aa0d24853d407e3b5575307268900ee2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772989721, "uuid": "307d51a0-09e1-43b9-b9f7-50f06b8a75aa", "comment": "Malware payload (Mirai)", "value": "c610006e592c549589c0de2d382efa3acad814ff", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772989721, "uuid": "7be2d8d9-6b66-4639-931b-ae709c61d7a8", "comment": "Malware payload (Mirai)", "value": "ba0267cf3e906f7ad127d9a9368c0c954afa1cf8dfd784bd2457796e5f65d103960c73b80507e748cb9c52c16eb3bf5a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772989721, "uuid": "a3f0a1d4-7783-4f4c-9fbc-e549b7c4c78d", "value": "T152F549917A68ED63C0451D7BAB7FC75933638E50CE9AE120D7C0DA8DBE8B150DE250B2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772989721, "uuid": "c6910588-071c-4e3d-95fe-4bdfcbcf62fd", "value": "24576:xIlwrLJuU6EVk1s7MReTTXiHu+NKfZWctnB7qvc3THsbrTwTD7UBD7dzbvxHLf/+:3qSMhVaO8VMsagWMn9W/tThsxQPdmm+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772989721, "uuid": "24c31927-fb5c-4607-9712-f659dbc1a84a", "value": 3553636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772989721, "uuid": "e9117550-f281-433a-8f9e-4e3cdb5e2dbf", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772989721, "uuid": "4617dc5f-22ee-47f2-a2c2-37b4b510e0c4", "value": "armeb-linux-musleabi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ec3b7e5-1aae-11f1-a769-42010a9c0008", "comment": "Malware payload (DarkMe)", "timestamp": 1772947110, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772947110, "uuid": "049b2620-a308-40b4-adb9-6ac0a0463266", "comment": "Malware payload (DarkMe)", "value": "54534edfd675407f770daa375b3b34ad", "object_relation": "md5", "Tag": [ { "name": "DarkMe", "colour": "#7F5968", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772947110, "uuid": "df3a2325-f250-46de-bef6-17ecc1d3f3bd", "comment": "Malware payload (DarkMe)", "value": "5dfb9954260d3b53adda4f22187442bfc437530c8fa96496e4539284e26228d3", "object_relation": "sha256", "Tag": [ { "name": "DarkMe", "colour": "#7F5968", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772947110, "uuid": "32815219-b0d2-4f00-a945-410d2922be00", "comment": "Malware payload (DarkMe)", "value": "89928abb000dcad73a256657e5103fe87f0ae0ac", "object_relation": "sha1", "Tag": [ { "name": "DarkMe", "colour": "#7F5968", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772947110, "uuid": "99073de4-f846-4b98-9f0a-984c4c623f65", "comment": "Malware payload (DarkMe)", "value": "ba948469bdc9eb9e9fcbc42f1dfe6471c6cc8a542f7a009fd2a6306c3cb439026529af0354b9a8b560cf8a64ef45a706", "object_relation": "sha3-384", "Tag": [ { "name": "DarkMe", "colour": "#7F5968", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772947110, "uuid": "1997d00b-071c-4b05-9d8b-7a67f1b28860", "value": "T13DD35FF6EBF478A1E105253379A4A17C37D3BC5DDD92452AE24BF11E2422DC228E5A0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772947110, "uuid": "8f7fc182-d0bf-46a2-8163-eab0f4edd6c3", "value": "3e847ec4ad926dd89c2f4cb28d036c11", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772947110, "uuid": "5346838b-9eb7-4189-9803-651b279de952", "value": "1536:a0a0PO/Ujf3OnwevbVfo9dPdb96r/3vQe1:LMU6nwezVfobP5e1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772947110, "uuid": "f9085749-18fc-4bc0-aa97-47e9365500c5", "value": 138208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772947110, "uuid": "e298b2e6-86ad-46f0-a87d-6caff89cba28", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772947110, "uuid": "a264f42d-2762-434b-a381-4ef55fd42492", "value": "drive_encrypted_forex_decrypted.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "517d5825-1b11-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772989662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772989662, "uuid": "74d5c9a6-5572-4af0-9448-13f6b54696dd", "comment": "Malware payload (Mirai)", "value": "9c459cb9db9f23bc2578038c6812af8e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772989662, "uuid": "76b7387c-765d-410b-855a-9923a79208a9", "comment": "Malware payload (Mirai)", "value": "5e600cd93d16868b09c89a2fa3862cc3869ecc6692ea54db25c4c7ab52eddea7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772989662, "uuid": "535a23a0-0206-4557-87e1-d496d6ffb9e6", "comment": "Malware payload (Mirai)", "value": "b08c1837d16f177be7b6c7e023535f94b13d4274", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772989662, "uuid": "98168cb1-01cc-48e3-97e4-fb518d09d8ec", "comment": "Malware payload (Mirai)", "value": "6691b4082ce6a0c9a4d01916c459d59a3a1e0931cd93c7551e180afa0dcdca21fe62f952fb752ba5321199b748521b64", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772989662, "uuid": "45edba91-d381-4669-9c2f-3f9b43739fd3", "value": "T10B4533F07F427F18954F28B96BF2CFA24811BC93E1569185C7A37D9A240870C2FB5DA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772989662, "uuid": "30d0f996-34aa-4524-9104-7779f82fc980", "value": "24576:E4iDyYF2FAxqYM5uMXXMUm1BQn7Asu6aOD9rPNUSdOVDO0yo:E4iDy9CqYM5tXMUkBQECaOr7OV6bo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772989662, "uuid": "a5b41860-e78e-4d88-9e54-9da2ff58a808", "value": 1205248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772989662, "uuid": "f87de78f-5c62-4ad4-a183-244af3b56a82", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772989662, "uuid": "b1085380-fc78-45bc-9dcd-739064bde626", "value": "armel-linux-musleabi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "adcc5a72-1b0d-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1772988098, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772988098, "uuid": "da987d74-0f40-4b7d-917b-4a106d7b59ff", "comment": "Malware payload (Vidar)", "value": "b4f33dff2cd6d66ed2e7bfd375fcd253", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772988098, "uuid": "513d8ba6-631b-4063-bf18-18f9a2b89d62", "comment": "Malware payload (Vidar)", "value": "5ea419572b9907cca2bbee5cae05f7f9c1be7e7cc7e3154c65247ffcb2556910", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772988098, "uuid": "c2a8bdcd-94c1-418c-ac23-ebd5302295c3", "comment": "Malware payload (Vidar)", "value": "10e08abf3b67f630ea88ede67daafcb8a2243a53", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772988098, "uuid": "4036842c-f60e-407c-919e-5f768e4da48e", "comment": "Malware payload (Vidar)", "value": "93c9b1f6477eb0a3199563bbac46e6fa39a0047e7ac3dda965cd2393e8a60196bc37217a79a9d54b3b624c3929d45b30", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772988098, "uuid": "80491e0d-32e8-49c6-9bbe-59e163260b84", "value": "T1C5C6D56F62A48F68C359813EC0BEBA04A4F37175077FC7E742A107548E22BC55DFAA64", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772988098, "uuid": "81e79b13-f9f1-4f88-9571-a08c36ac8240", "value": "068780fe56d60c9502ffe606f8c04be5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772988098, "uuid": "99ebeed4-3b06-4bb5-9cd5-69e53edeb5fd", "value": "49152:gX18qps+OYzlmB7ki3LfrrOSVhi04X7FOxHZ8mUFqz5L0TVtoeoMwNRcXCBz+COw:1zCoeoTntBu/KBis/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772988098, "uuid": "2b1fc720-6c63-4c97-8687-d3600d3e05ab", "value": 12147200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772988098, "uuid": "8489ccb9-fe9e-41c1-a306-de3fb4364669", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772988098, "uuid": "6bfea623-b351-4401-9f5b-c4d8c5f03e55", "value": "1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "359c9bc7-1abe-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1772953967, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953967, "uuid": "aba58bbc-3383-4050-8689-5d4b9e44fac5", "comment": "Malware payload (RemcosRAT)", "value": "2b2a5af0fee570ef5c7e91df4159227e", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953967, "uuid": "884b81d9-dccd-41dc-8157-5981383e5866", "comment": "Malware payload (RemcosRAT)", "value": "5ed9d055ae40ac3335d78178f101c19faaedae8237b326278b5bbb7f80a6f378", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953967, "uuid": "9ddb256d-92f8-4956-b49d-e52288619a31", "comment": "Malware payload (RemcosRAT)", "value": "8b89caf4186eb5de73ce3b491d7abfd127e410d7", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953967, "uuid": "a473e51a-98b4-4c96-a83e-3862d9fde6fb", "comment": "Malware payload (RemcosRAT)", "value": "46ca3f8b8750dedc2e6d88bee3420d6d21daab062ab92a263017d16636c864aad50666ce805b585282662c8f172f246c", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772953967, "uuid": "6e345e06-3838-4f02-a355-d4a5c630336b", "value": "T162F59E53DE886388D65D3B0B94EE6212FF7045EF290D411FF6A67A8CF95F14C201AA8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772953967, "uuid": "c15f3c4c-6ef9-4ff8-8eca-94f0097e92dd", "value": "49152:vmbqZ2dJajWg8nPlzE2NAepxMovPLBNgjf:J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772953967, "uuid": "f1b59e7a-6099-4133-8057-ecb2d1f2a44e", "value": 3352900, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772953967, "uuid": "b400ea31-ba39-405a-9fa7-b128644d912c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772953967, "uuid": "c2b7f942-633a-48bd-83f5-b3135ac389f0", "value": "2b2a5af0fee570ef5c7e91df4159227e.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e840f61a-1abd-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1772953837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953837, "uuid": "ed9d3eeb-e41a-4f81-9668-5ee17e276bbe", "comment": "Malware payload (XWorm)", "value": "6695711ff9d67fc332e66d9c7dc800e3", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953837, "uuid": "9832cc29-da7c-4f19-b993-fc0a7ad135ef", "comment": "Malware payload (XWorm)", "value": "60a2cf5653b0a5954da93d4b076b89a3fa6068cd0916ded7b255eae0114d3f3b", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953837, "uuid": "1d00b137-9398-4323-b232-8788faee869f", "comment": "Malware payload (XWorm)", "value": "06f8d3d9d8b3e0f08c46bf32ca2305555a7a7fed", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953837, "uuid": "6e29545a-1bf2-4296-8f20-f1740902dcb8", "comment": "Malware payload (XWorm)", "value": "aa5489fe18140f7c2024cafa24b9ea9eb65e6114001b7feb5772fc731accab4856a6daf3334819125157fd16ced56294", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772953837, "uuid": "df805d9a-4c82-466f-937c-3a826775bb98", "value": "T17415026A2DB50BB98B1FD84C835CB170EE438E47B212467EE66CC6CF898095D5AFC075", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772953837, "uuid": "98485d95-8380-444f-89e7-01668ee3db29", "value": "768:DRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRa:qZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772953837, "uuid": "1ede70c3-c347-4501-9199-c6d3b6864ee2", "value": 923344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772953837, "uuid": "a56c3986-1ddc-4c75-87e4-6cd828155942", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772953837, "uuid": "9cd07fac-ed63-46fc-820a-779a20d8b5cb", "value": "6695711ff9d67fc332e66d9c7dc800e3.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0da70cff-1b1f-11f1-a769-42010a9c0008", "comment": "Malware payload (Stealc)", "timestamp": 1772995561, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772995561, "uuid": "c6050394-5d73-4bb4-affe-6b311dc6f735", "comment": "Malware payload (Stealc)", "value": "cc3107c5145d4ea590e1e9eaf8d70969", "object_relation": "md5", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772995561, "uuid": "b15519f3-8759-4f95-9415-2bf622634cd3", "comment": "Malware payload (Stealc)", "value": "60ba79bd1ecfa0c73aa429e8821be3c814fd81d3df702d052725e4e757030711", "object_relation": "sha256", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772995561, "uuid": "c27c9d7a-fd11-44a9-acbd-a5b67e4418d3", "comment": "Malware payload (Stealc)", "value": "e6512339d2c6500631cbde6ef113066455aa6f16", "object_relation": "sha1", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772995561, "uuid": "2aaf0e4c-5deb-4662-b404-5d1a2e939bfa", "comment": "Malware payload (Stealc)", "value": "efbef383f512be8f00e269869196dbfbe29b641fb6bb279fb4843260b5f22572aa50cf0c75bdda84802d29afd1e41960", "object_relation": "sha3-384", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772995561, "uuid": "2adfe42d-d087-4136-b7f8-4edd5c1e16df", "value": "T132B55C067CA044B6D06D9736C9A262A27B31FC0A4B3277D7AE627B783F767C05A35710", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772995561, "uuid": "42a95ce9-ef4d-49a8-86b5-1dceeadabe3e", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772995561, "uuid": "1e559ec2-6a0b-457b-96fb-f39695f5106a", "value": "24576:hYnW4TS3OxYNdw6DYq6KZKS6pWHfvVaFy8Vo8MLQ2dTMZAh6+eVRQ2P7GiWkKG6f:hYhTSyadBOKh+WsNO861MKh6+eLP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772995561, "uuid": "c7d67dd7-0403-4f76-b9f7-eb7d5b778c8a", "value": 2427392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772995561, "uuid": "a030e6e0-93bc-46e4-8c94-629fe74ab743", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772995561, "uuid": "cc7d0db9-6b79-4785-aa3e-5b457d500673", "value": "recuva_professional__technician_(2024)_full_espa\u00f1ol_[mega].exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12a92ff3-1b09-11f1-a769-42010a9c0008", "comment": "Malware payload (ToxicEye)", "timestamp": 1772986120, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772986120, "uuid": "59ee6ad2-0337-469b-afef-1252f6c19858", "comment": "Malware payload (ToxicEye)", "value": "8e7300418be50f5d0952ab4825a3f90b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ToxicEye", "colour": "#A65E4B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772986120, "uuid": "7f7634ea-e027-4b82-b7f8-0facc79a57d7", "comment": "Malware payload (ToxicEye)", "value": "63642b34140b25f3a46f465d74d6ebaa1d0eeea2b1e0a07b10ca4aa6c038c212", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ToxicEye", "colour": "#A65E4B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772986120, "uuid": "2b94a18c-8719-4c49-b8b6-eea19a616f74", "comment": "Malware payload (ToxicEye)", "value": "75f8850c57e4aa4d03427c7a4cfee1931e4c56d1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ToxicEye", "colour": "#A65E4B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772986120, "uuid": "3cd7a99f-7ca1-4790-9062-064e651a6a3d", "comment": "Malware payload (ToxicEye)", "value": "fbdc57b85f5ea6e0b62b0f44bc7343129f2bc0b78e7fd82bfba0290f04d10308f0f6b76eb92356b2436af41e64e91af8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ToxicEye", "colour": "#A65E4B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772986120, "uuid": "033bc3d4-dd84-4676-97e0-1762a64811bf", "value": "T155E3E72837FD9D14F1FFAF3AA9B251040B32B816A972D34E0AD5A45D2CB2B54C914B73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772986120, "uuid": "483619fd-5deb-462b-8ee5-d2027106ff9c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772986120, "uuid": "066840bb-120f-4c91-8dd8-d206cab1e9d3", "value": "3072:j/fZ83DkWciYmvic51Jjo95+l6QW8XCrAZw9:8gjm6c51i9kf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772986120, "uuid": "1393656f-574e-4309-93a0-0ad727c66964", "value": 148992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772986120, "uuid": "102b7cc9-8fd0-4516-866f-a82e5561b6de", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772986120, "uuid": "f2f5bec6-5197-4904-bad5-118e26f4df06", "value": "Astralis.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f20d8b11-1b31-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773003675, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773003675, "uuid": "df3765b8-04cc-4602-8dcd-4f396d05b1c8", "comment": "Malware payload (Mirai)", "value": "2b173b39bea6336f5cd5a624ee7cccfe", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773003675, "uuid": "d15d67e6-ac87-4b99-9588-431bed1e73ad", "comment": "Malware payload (Mirai)", "value": "64d50b757f2bf71304810e5b1c500462e2232dac2f9985bfde8719fba7726492", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773003675, "uuid": "25ad331f-3424-4356-891c-734cee4bdb14", "comment": "Malware payload (Mirai)", "value": "e2ee1734c72ca15a3aa246f8df060c8b760b2d19", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773003675, "uuid": "998ab4e0-3fdf-47f6-b07d-0424411ae171", "comment": "Malware payload (Mirai)", "value": "23d7fa332e4822c37fcc880f193430292b9fccbc4d7b9e31edc0e9149fa8da1a3159c84759617bd7ea395febde7ca2eb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773003675, "uuid": "79cc49e7-6e3f-4e2d-a7e0-ce80b4ce3b3a", "value": "T10F13F1FA1745C5ADE1B6E1B6363887D02A650B6191809EC7178DBAC3E898C35390B7F3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773003675, "uuid": "31b26685-cefb-4c88-acde-6201045d7a65", "value": "768:p3HQSGrNCfslD2ES6/fhlp3h/ZwlZe8dDHQYt8jbAI/qFb5zk3owrpC3HjmaYvVh:ZwSaNCo2EJnp3h/Z6XdDdI/q55zuCTmx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773003675, "uuid": "cf5bba8f-1cb5-485d-a12d-0c7477e408f3", "value": 45436, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773003675, "uuid": "fd921467-7bbf-4df8-8468-c452395a44ba", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773003675, "uuid": "e6808edf-0426-40fd-990e-e97cdbaeb84a", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bf65851-1abe-11f1-a769-42010a9c0008", "comment": "Malware payload (Heodo)", "timestamp": 1772953950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953950, "uuid": "04151e65-5a14-4833-ad59-fa29e7dc32c5", "comment": "Malware payload (Heodo)", "value": "bc633b52efd493bf6be65099fcd89fbb", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.sae", "colour": "#93E1B6", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953950, "uuid": "0c4793eb-d2a6-470b-9829-1f84dcae8954", "comment": "Malware payload (Heodo)", "value": "66406a9f58f42fb6f7d1e31e3aee159641ca5e257521dc325e49ccaec4aeba22", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.sae", "colour": "#93E1B6", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953950, "uuid": "15533123-78ce-4b9b-a7f7-d88b28c33c7c", "comment": "Malware payload (Heodo)", "value": "4e3e4f05c3c9ac911d948cd0f3e612d6497fe21e", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.sae", "colour": "#93E1B6", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953950, "uuid": "6c3090f1-57c6-4668-a989-ba5529fc4720", "comment": "Malware payload (Heodo)", "value": "7db8f5241e240cd07c570aa54ec7f4ebda0cfee84ac7f3cc35495b0c47d9f3211fd98c4416c76b241488feae3714f89b", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.sae", "colour": "#93E1B6", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772953950, "uuid": "f60bd926-7a20-4c58-962a-eb62e386d83e", "value": "T110676C0272B011D4D169D5398B0BD957EB713AAA0F71D7CB12A0D65AAFB79F01CFE220", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772953950, "uuid": "3ddc0ac1-2935-4481-a845-d046dac3703c", "value": "1f1cdd23e3f42cade6020fa0bc6d76b5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772953950, "uuid": "e1081784-2b4b-4055-9889-028a0ec80a83", "value": "393216:7tKMmQIrNrO5h/E0omQBFviP92cveWRe7CXLvhHJxZpZ2Sh7/Blqi8bo2X:PArFB4C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772953950, "uuid": "dd5fce87-58a5-48b5-b6d0-3b16173315fa", "value": 32033792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772953950, "uuid": "188561f5-04ba-4261-bf62-da414d0b2e9d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772953950, "uuid": "e7db1b21-3725-4f6c-b0fb-aeb7828b74d4", "value": "Arma SE7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5e6613a-1aff-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1772982126, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772982126, "uuid": "ca6c9c8d-bb2c-4367-a732-4e1640944bc7", "comment": "Malware payload (Vidar)", "value": "c13c88f03139d0f9aeab85263af1851f", "object_relation": "md5", "Tag": [ { "name": "pw-2026", "colour": "#4CE282", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772982126, "uuid": "cd8b9fa4-5edc-4652-bb51-ac29e1654f87", "comment": "Malware payload (Vidar)", "value": "66e47e0816d04089c407ca871feed51aea3ba92ac9446a7f6def70efd8416177", "object_relation": "sha256", "Tag": [ { "name": "pw-2026", "colour": "#4CE282", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772982126, "uuid": "ff5a3bf4-af08-4b0a-82ba-6abf691f9606", "comment": "Malware payload (Vidar)", "value": "c1d2a78393b834e54312636f4f4a9f17ff4ad7f1", "object_relation": "sha1", "Tag": [ { "name": "pw-2026", "colour": "#4CE282", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772982126, "uuid": "c1d18290-3f23-46aa-ba39-804249efae61", "comment": "Malware payload (Vidar)", "value": "8ab21dbcb1f0f152c31a49fcf7d8e515528ec09a40f4967440db647d3c9b021f6c4ee9d438d7ebca4095ebd85242f65f", "object_relation": "sha3-384", "Tag": [ { "name": "pw-2026", "colour": "#4CE282", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772982126, "uuid": "a48d80aa-ccbf-4ea1-afb0-44f447865efb", "value": "T1C5C53383512F15DE22D1FF299C54E6B9303C2A5D726C4079F1A168F702A02AA7F2D7E7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772982126, "uuid": "5ed3ee82-999c-43ab-bf2b-550fef1a8b8a", "value": "49152:1awOgkIKZAQE4CeqL3/jI3j042vu45oJcGQ19vifwjVTbF5p9xSEKsd:1ZHf4sjUj042msoJ0vifI/19KO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772982126, "uuid": "cfcb81b2-f1f6-45ff-91c0-38fcb47fafbb", "value": 2654206, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772982126, "uuid": "86619dad-71cf-4e3d-975e-fb4e351fd23e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772982126, "uuid": "462687b6-5301-4642-80da-e3d63907a6c7", "value": "Kiddions_v2.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62e9b597-1add-11f1-a769-42010a9c0008", "comment": "Malware payload (Phorpiex)", "timestamp": 1772967357, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772967357, "uuid": "b25f5ae1-420f-47c4-92e4-e6cd60166e18", "comment": "Malware payload (Phorpiex)", "value": "8be0eebc6fbfcb19a152f22125be42ea", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772967357, "uuid": "c9829470-dfe9-4e9b-aa05-0dc4f46a551d", "comment": "Malware payload (Phorpiex)", "value": "6827446fff9f976b49baf903de1d413bf16e35cb9abee2c4f0a0d4db4530e167", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772967357, "uuid": "8fe96254-b96d-4bc0-97bc-5e47927e6528", "comment": "Malware payload (Phorpiex)", "value": "270409ad987c9893db7a30cd6e8a5adb16c3e15d", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772967357, "uuid": "f3c06a70-fc34-448c-821d-1d57aa0723d2", "comment": "Malware payload (Phorpiex)", "value": "2f6c629820d78fd9d5e9fe5de8832b12dc095e625d66b1fdc61a585534d9c378e7a086174bd7a9830a23b9ab4441e995", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772967357, "uuid": "9f5e53fa-d04a-4858-bf0c-200396004ddb", "value": "T127F1190EDE928021E78D0AF15EB680858B7D067327C251FFFBB304999FE52D584A2272", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772967357, "uuid": "3a5bde1b-fecb-4eaa-bf18-4bcdfa3b18ed", "value": "d0a7dff1fde8ee871748efe2998b0fc4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772967357, "uuid": "61b35529-b7bf-4a0f-a145-4a0cea9e37ba", "value": "96:zGRPaRdja3Z4z8drbD959l24eTNu5EhafKEhJxGENUOeA2qpCC7tCEIB:ziaymz4ll24IYA8bJxTNUOeAtpfI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772967357, "uuid": "42e215a4-30c7-440f-a307-0614546f5238", "value": 8192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772967357, "uuid": "6ea7cf3a-6e02-4c63-ae15-a133e6b5f6b5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772967357, "uuid": "424b30ad-9d7d-4b73-b387-d594f8c13973", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0ebeddf-1b32-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773003968, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773003968, "uuid": "e716d45a-17d8-46fc-a960-ea42ddb1dd06", "comment": "Malware payload (Mirai)", "value": "f0c23cab4faa9457a74c8f8d83f29e61", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773003968, "uuid": "145d1391-3be1-4f9b-ad32-20c6d5e458f0", "comment": "Malware payload (Mirai)", "value": "68ac7cfd85275ed2e254a31dadab604a579d6bad0b00f799634873890870feec", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773003968, "uuid": "9e0a2990-51b3-4705-ab30-0e1f9b04322a", "comment": "Malware payload (Mirai)", "value": "df95245b0a7b351f7f9934f98177b413b603e80f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773003968, "uuid": "2dd3f057-6173-42cb-8d41-44ab7617fe03", "comment": "Malware payload (Mirai)", "value": "4e57d68fa0a44b0d3878f3fbf98cc5a05a2f8e74fc52a64ce328258c7e5934c34078898510c607039dd541232a664a0f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773003968, "uuid": "73e39f60-43a5-4d8a-b400-3570fb4b1fb4", "value": "T1B9158D2AB2B3F57CE00BC03457DBCAA15535F07522212DBB26C4DA353D6ADE11369B63", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773003968, "uuid": "3e069a3b-46e3-4d14-a06c-a0f03fb1bf75", "value": "12288:9S66wxNg2j4PgrdvHYXq73+SPmh/U1OTlWqz3ObhsPqoq1dayUH+cdaHX:s6txNg2MP+NElRlz3AsgS+0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773003968, "uuid": "5a1ec759-8729-4b67-843d-1492a49b8dc4", "value": 957256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773003968, "uuid": "1f8d1015-49de-4c18-aa48-66179a415ed4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773003968, "uuid": "710f3da9-703e-42e8-948f-03dd36f8b97b", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "def3ee28-1af8-11f1-a769-42010a9c0008", "comment": "Malware payload (Hajime)", "timestamp": 1772979161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772979161, "uuid": "958c4847-6553-47ac-8bdd-6473b32ad4d6", "comment": "Malware payload (Hajime)", "value": "c354d0e5fb67cded7c33968b8cccc9f4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772979161, "uuid": "4b1bc11a-bc4b-45cf-8029-d0adf6c9920d", "comment": "Malware payload (Hajime)", "value": "68f15087e64bd08ec305a99ee9c2f0ab16a24b28948b5e71841622ed67da67b0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772979161, "uuid": "ca754e8d-ae1e-4b29-89dc-596904c7d816", "comment": "Malware payload (Hajime)", "value": "d07144e633f2de6a488aabaa4e34977609902f4e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772979161, "uuid": "03d9e611-1363-417b-b2dc-8821690b5d20", "comment": "Malware payload (Hajime)", "value": "a53e7203879b4df9bc7b3818f88dd8af39d568ae8544b72d17a8a11578d989d1154ca6ce56d04f13058fa286f52095db", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772979161, "uuid": "512a58e5-5bab-4405-a58b-e247f2057810", "value": "T1B872E14A2E9C3B07E4B255F2F33C7E49F3052E8D76679417D199612350B301AA114C3B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772979161, "uuid": "7265b855-2a43-4375-b3be-b39a3a68cdfc", "value": "384:YTYXvQDuYY2xZ6VTgDK4mpwTl5yejHSDeWBbo7hcV:YTYIDfYG6ZmewZ59+V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772979161, "uuid": "17de5fec-5f8e-4e5c-8c7a-e962f27de18b", "value": 17524, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772979161, "uuid": "48d1cccb-d1c2-4100-9adf-c12db0997875", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772979161, "uuid": "5f97b474-308c-4cc8-ad07-7ee3f32e8f95", "value": ".i", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21629ad8-1abe-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772953933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953933, "uuid": "4608246c-054b-452a-8f25-80681e0ed9f7", "comment": "Malware payload", "value": "647f857c4e07390772a9490ee76b03b8", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953933, "uuid": "966ccfdf-b1ef-4fe2-b3d4-4a0bea963343", "comment": "Malware payload", "value": "6ad440d0b500a80bc7c045b83d1edccd0d2d0dc516ba3bd29b6b919fd3565fe4", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953933, "uuid": "c67be0c1-f185-4ad2-931a-900daa51fc4d", "comment": "Malware payload", "value": "e73a6692d1fc55ba724917d993ceb9cea84573ab", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953933, "uuid": "71d0d597-ebb9-4477-bf3a-1f834340532d", "comment": "Malware payload", "value": "bc7a4e90e11f7c6e4040125ba022e0ef9200ace3440217194c776c68ab3029db949f877334029f70386fa62409c748c6", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772953933, "uuid": "2fac4806-b00e-42a9-b58c-ae3a38f9b59a", "value": "T1F8F2FDA1D1AC5B5E8DD07DCEA4056C9B0065F93AE1B3E837F62306EACBF578845122DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772953933, "uuid": "9c136010-3ffa-4700-be49-432109674b5a", "value": "384:fqLLNzlD+HBW8ECaeLCEnyXEYgCm38Ci3be2J+qYNl8lbZfwTc8mBqGSrPVaHVgw:Q+s1EVyXEY7HVThcm40VgqbF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772953933, "uuid": "7934be95-5d65-428f-8df1-d125c8f74140", "value": 36686, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772953933, "uuid": "eede90fa-4a47-471e-846b-eeff3a72a3bc", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772953933, "uuid": "cd7229ea-66da-41ed-8d73-d9384b5883d3", "value": "kumar.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "911e67a6-1b2f-11f1-a769-42010a9c0008", "comment": "Malware payload (SantaStealer)", "timestamp": 1773002653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773002653, "uuid": "79541dcd-9b4e-4dac-97ca-420f10c9f48d", "comment": "Malware payload (SantaStealer)", "value": "3458b29de05a9bf9044509651ee815b2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773002653, "uuid": "64b588c4-1a70-4fd1-b319-1adfdeefbe3d", "comment": "Malware payload (SantaStealer)", "value": "6b3de9ab8cae40af77d551c52eca8b76fc1e5a4b4e0f189cbaa80e3218ce0cfe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773002653, "uuid": "d8c56d32-5836-4183-9f42-96f5bbfc6ccc", "comment": "Malware payload (SantaStealer)", "value": "a9129699644c4edceb372bda59d49ff0ca2e7ef7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773002653, "uuid": "d02c8a73-9e8a-4e99-b430-40c5b3b2f6a0", "comment": "Malware payload (SantaStealer)", "value": "cbcc3236a85c969121bc34012bbfe48fe202520525b0e43b03672f2cd5e544ab05721a2e1b483d2c934d48ba170bbf08", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773002653, "uuid": "4641c3cd-81b5-4456-908b-05e85c819b27", "value": "T171F6281024D96607FD7EEFBD85DCB6440F7AB2953722EA389B410DE90FD1B08C9429A7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773002653, "uuid": "b4152b3d-5e63-4fc5-9555-03e3d9f011e7", "value": "196608:W0c1TC6SmXsZuJPDo5wEK1/cqFkFAflYE1Xdwqfk6944GUD264C6AXjQ:WxQmdPDoiEKFZ2idZfk69hGUgC6cjQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773002653, "uuid": "ad2f1e37-2bed-48d5-a4ae-613c11108649", "value": 15973888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773002653, "uuid": "ea2550b8-f1a9-4497-ac43-6695d1e7adfa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773002653, "uuid": "bae239eb-0b8e-4d7e-ab7a-6ab823d2c160", "value": "EasyActivator.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13a92d06-1abd-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772953480, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953480, "uuid": "2be0e907-29d7-428e-a2e8-d664e171f923", "comment": "Malware payload", "value": "a18dc336e1e89d1c5ebe2b087ce1ccc1", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953480, "uuid": "e8f86070-8ec7-40a9-ab57-f8c894f36b62", "comment": "Malware payload", "value": "6c14d697dbc5dcdc7b17da23e6f2b29a47efc0a09ec011c78469d96d8b226f42", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953480, "uuid": "c694c62b-ee40-460b-91b5-b0185ce7634f", "comment": "Malware payload", "value": "6f572a639229140ffeaeaf9c5761d491ff00f5ac", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953480, "uuid": "da5be19a-826f-4c1e-bf27-913b53be45da", "comment": "Malware payload", "value": "ed6c675a91549764636b3997118443f122498bdde76783d02ece2a7a0c5d0ad5d280f9cee6ae941b3ba91dd987ebb120", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772953480, "uuid": "2cd93940-72d4-430d-b765-db259dec0208", "value": "T10131641027F54708EAF68E3978B9A3318276F811ED22DBDE1340658CAC25114E87AF2F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772953480, "uuid": "13baf0b0-5623-4ff4-9255-45ce5a3478ac", "value": "24:8rEEkgoJCuesgUSgK0zgP8WYbCROAXWPK+/CWnvU7lEykHX44I0w4L4I0CW:8rEvC6PBgxYuTWXv4lP63I9I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772953480, "uuid": "1a0d37be-33f4-4bed-b8f1-a8dd7eee90d0", "value": 1819, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772953480, "uuid": "1f4b99e8-8f8f-40e8-9d3b-b15ae25ae310", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772953480, "uuid": "19355020-20ce-451a-907c-cd9cdfa7a912", "value": "Databases involved.txt.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72143a0b-1b11-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772989716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772989716, "uuid": "39ed3fce-317a-4ff1-95b2-fb1108c3e670", "comment": "Malware payload (Mirai)", "value": "ebac90c1c4b3cbfdbf5d3340697f01c1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772989716, "uuid": "1f19b345-e7c4-49b6-a13c-32d6e5e81301", "comment": "Malware payload (Mirai)", "value": "6c89f6dc510e6c79134f9a916966f94f33cf105d4384c6dd6cb24c730a772934", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772989716, "uuid": "ebd61b6c-043c-4ccb-8175-1fc85d680606", "comment": "Malware payload (Mirai)", "value": "bb668a283de2ecebdd6f3c33b53a773d19114431", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772989716, "uuid": "acf60d5d-7307-4d9f-b94c-57cc8066d034", "comment": "Malware payload (Mirai)", "value": "f7a80bcf479410928b52dd39b663ff57cccd431d960b04172b0f32804bab36f15a526839fa3462b9ef1c55c00dc594a0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772989716, "uuid": "5e33d472-f5c8-48fc-9955-41e8a8439ccd", "value": "T19BF55A62F891DE93C6C0567ABE5EC2D877131774D2EF72028C0547283BBB96B0A7B152", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772989716, "uuid": "760a8fce-4482-440c-a9d5-ea234cba4475", "value": "49152:A2NWYlKePvQFIXpOwdnB+vnIfgr+XrWCQPA:b00vQZyqnHaWCV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772989716, "uuid": "36a0ec20-989d-4755-8ced-c97c502095c7", "value": 3549544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772989716, "uuid": "3a56704b-87db-446d-b376-9ed6c4b4d980", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772989716, "uuid": "65f6ae19-1b1a-4aba-96c1-0d8514b1233e", "value": "armv5l-linux-musleabihf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee7b0189-1abc-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772953418, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953418, "uuid": "c32e665e-6faa-48b1-ba1f-e893432218ad", "comment": "Malware payload", "value": "eb5e7af59d48f91031a40c70655ae6d7", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953418, "uuid": "ae043474-2f6b-4a4c-8d54-08c5f5124b2a", "comment": "Malware payload", "value": "6eb1475bc08003547ee306fccd0b5d9dee3dc4d1606de8c95657a8296502fe8a", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953418, "uuid": "ab393a86-f479-4667-a59a-8f4b91e625fa", "comment": "Malware payload", "value": "d277f163dde01d135fc8daa926253dc20bdd8918", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953418, "uuid": "181bdcf2-2c03-41ff-b927-047da4653f74", "comment": "Malware payload", "value": "ea07c3cfbc1fba5c70eeb01eb8cb000a80e0da0efdb9e9edfe02a2b2a24068e10134003272f60c8abbdd9e39327d4d47", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772953418, "uuid": "b001c280-785e-4bd9-98b2-2efea89418d3", "value": "T1A3C2534E3DC1B0746F23F4339A2FA63AE12E7D45668CC08D97675018F92DB08D576AE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772953418, "uuid": "61d53db2-65b0-481b-b85d-fbae35a31c96", "value": "384:oSE7n10LhB5flET4OYlb0+LMFafZcYrD/F2g/MTcqHy9I+IWG7GRbRl:I710LT59ET4Ok0+LMKZcYrZ28gcIVyl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772953418, "uuid": "53dd2e04-f244-4e25-9269-2dff34882b2e", "value": 26194, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772953418, "uuid": "1582da7b-c175-4bcb-8946-26b1aa5d13fd", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772953418, "uuid": "dba65ebf-d0d8-4141-a8b7-e3c7fdeb4236", "value": "DHL_Overdue Invoices 101152025.PDF.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79469c08-1b11-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772989728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772989728, "uuid": "6cc224f3-d444-4bce-8139-89157f104f59", "comment": "Malware payload (Mirai)", "value": "19184cdc009c71d2cf3a8dca36321d4d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772989728, "uuid": "845c4c0e-7466-482f-8160-cea6b6aa1528", "comment": "Malware payload (Mirai)", "value": "6eb64e2c845f686d881f1ad6a3a9650e41074322e643e3e2e4d5110d4aae68df", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772989728, "uuid": "0f7a6d0a-db2f-49ab-869d-a05061f6aa1e", "comment": "Malware payload (Mirai)", "value": "0453ba39f2e8882a31e26887ad394ffa59a8afa4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772989728, "uuid": "8822105d-cbf9-4558-89d8-6c4b2d45a9ef", "comment": "Malware payload (Mirai)", "value": "831dfc0ad210da7eb92f2053c2b512c2846222e2f3471bf0d0edb89b4db3133fcc8e2b3409db40c9771cf010ea55244d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772989728, "uuid": "6db20707-edae-4052-823b-6106d5f3d2a5", "value": "T12CF54962B892DE93C6C05675BB5DC2EC7B175B34D2EE3206CD0443283BBB96B097B152", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772989728, "uuid": "c01fc499-a70c-40d5-947d-f32206e39aa2", "value": "49152:ZVzckb/JVlc3QTCtZLZRWSeFfuz5Jr+uCWCQPd:ZpnhVlc3dPRvfJqWCg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772989728, "uuid": "53ac9efa-baa9-45c3-92cb-8fa59687a18d", "value": 3545444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772989728, "uuid": "3929e709-f848-433f-a60e-a553e91465d0", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772989728, "uuid": "de731b7a-a574-4658-b3d5-1b01811b4fa1", "value": "armel-linux-musleabi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea6455bd-1b29-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773000226, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773000226, "uuid": "0c454092-02d6-421e-8d48-c8a78f869683", "comment": "Malware payload (Mirai)", "value": "840ed22229f05502f26b60fa26cf6db4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773000226, "uuid": "b4363479-eb3e-42c5-8a87-aad93b9f26df", "comment": "Malware payload (Mirai)", "value": "6eece6480cfea74041f341cc167355e23b347a277d2389903cf9e8cb53166400", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773000226, "uuid": "44c8da31-db87-4b02-bf9c-bc7bbc60e869", "comment": "Malware payload (Mirai)", "value": "42ba9ea3928af9d6390f217a3e937a0b5b14e33b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773000226, "uuid": "08c692bd-6760-480b-a433-9509a43def11", "comment": "Malware payload (Mirai)", "value": "4f8c1118eeb0f0fd77a7abc764822ec180eb0f3b2fb3de115d2b3953a0dfdde0297b0d7b1cc4168054af246191e15d32", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773000226, "uuid": "ddc4560b-fd63-4ec5-aa9a-80312f7f7cc5", "value": "T18DE32A077581CAFFC087D0F40BEBA93A9D31F85E1535B19A77A4FEA11E49DA02A1D620", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773000226, "uuid": "8b956212-81a5-4dba-bb6e-f1ba49bebae4", "value": "3072:+HMTgGWo7WM6WqGXjhwf8nClCpPnmmOO1H16SCQBG+INYIarqU:sMTgGWo7WM6Wqn6rkNwkawarqU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773000226, "uuid": "f15c622b-724e-414f-9b6a-18e4449868e0", "value": 152160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773000226, "uuid": "f99c95dd-d676-4fcf-8158-00b2528d41e4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773000226, "uuid": "6e8477ec-95e6-4131-bb67-2bfc253b9b9e", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e57cf4a-1b11-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772989656, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772989656, "uuid": "f3a75e04-1e16-4cc8-8d78-6cddf7e9ec18", "comment": "Malware payload (Mirai)", "value": "74bc1bc502cca121846e22643037eead", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772989656, "uuid": "408b3908-2940-44bd-970e-24bb7ba340d4", "comment": "Malware payload (Mirai)", "value": "704bd520f663040e9c64754e2e146b5533f3284cc7c5818782a74e6fdc740208", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772989656, "uuid": "57b1475a-9945-4e5d-a517-ce64ab8a6094", "comment": "Malware payload (Mirai)", "value": "ae086323dce05d13ba4389f347083c88c1f70ad3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772989656, "uuid": "beb770e7-fd1d-49af-8557-ee75d68cfc12", "comment": "Malware payload (Mirai)", "value": "f37cae465d0b0c4ede099ecf6d375c2dccea06de6685340e0f67343e921c4de08f6ec8cda5708ffa8a2c8cb4c6371baa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772989656, "uuid": "457320fc-f83f-46ad-a141-d467e44a9f07", "value": "T19A4533EABDCBB1826939B1D8075CF0D151135BA5068AF89113A7ED36CB6F1C02BE458F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772989656, "uuid": "10a44a3d-d1b1-4ab8-adc2-466bb053b0e8", "value": "24576:9iWsNVStmY2sHjDISX7bVefQHWOpuki7wogTJ/ah8:4WsN8QY2sdX7bVerOpuOTBo8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772989656, "uuid": "e7f11aeb-c5ec-4a7f-95d1-e45aafa235ba", "value": 1208324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772989656, "uuid": "c5ffe0d2-b9dd-48fb-8c09-745b3af47ec1", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772989656, "uuid": "68241146-4620-438a-bc5b-3e72057dbc5a", "value": "arm-linux-musleabihf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2672a6b-1b0d-11f1-a769-42010a9c0008", "comment": "Malware payload (CryptOne)", "timestamp": 1772988079, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772988079, "uuid": "bc96251a-ab9c-49e4-83b2-be3030eef515", "comment": "Malware payload (CryptOne)", "value": "b099b274b740bd7c1c4c31a72780352a", "object_relation": "md5", "Tag": [ { "name": "CryptOne", "colour": "#62260A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772988079, "uuid": "c6dd0655-7da2-4d4c-9377-6ad146e7c5d4", "comment": "Malware payload (CryptOne)", "value": "70b4e2f141659180e495325aed0cb6cfd038542ab995b1b359d6456ed3e8402b", "object_relation": "sha256", "Tag": [ { "name": "CryptOne", "colour": "#62260A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772988079, "uuid": "41604b54-8780-4790-a86c-d50267873fef", "comment": "Malware payload (CryptOne)", "value": "fccff81b54f9b58f290a7aef1ac3b224d10bb262", "object_relation": "sha1", "Tag": [ { "name": "CryptOne", "colour": "#62260A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772988079, "uuid": "fd0883ef-092d-480a-b7b5-2de9e106978b", "comment": "Malware payload (CryptOne)", "value": "9c0fb6f77a3249c5c68ee7a80cb1bd12f91a3af71e3442532fd93d4f77cd7a97fed1947808718b02a72b253c361430b3", "object_relation": "sha3-384", "Tag": [ { "name": "CryptOne", "colour": "#62260A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772988079, "uuid": "10730ef1-c524-4db7-b1b7-343bd145c54b", "value": "T1FD26F016DEE15438DFA50E35640A9B0BCCF57C02AEDD74783AA81C5A9C3E291EE1DF06", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772988079, "uuid": "fbba79bf-fee8-4eff-b67e-b8d2b98f21fe", "value": "e8450cd9fde12fe86ba788a327b66219", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772988079, "uuid": "4be3d957-e9b1-4762-9869-64fc387e9028", "value": "98304:oxJCtLCWT05T7tgExCZlOB0tsOeBb7UKzxhWhtt5M+l7veG0:2EtmT53tgEco0tsV7HWL1lreG0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772988079, "uuid": "c9586068-a362-4373-b857-54b881aaef0f", "value": 4536320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772988079, "uuid": "0eab0948-7e0d-4ba9-8de8-627b7a0b1903", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772988079, "uuid": "8f6de702-3c6d-47e4-93d1-5cf8391695c2", "value": "2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c65af5f-1b2d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773001786, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773001786, "uuid": "edb95891-7a32-4744-b768-0639894f0d8e", "comment": "Malware payload (Mirai)", "value": "fe914c151ed78187ef4b918bf07fc142", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773001786, "uuid": "895a75e5-15b4-4309-9983-29998467ca34", "comment": "Malware payload (Mirai)", "value": "719cb449434fbcb67877347d9f388ddb5451d802354ec07077c245527483db65", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773001786, "uuid": "8cfc7ed5-0160-4de9-afb6-217f8c1aa66a", "comment": "Malware payload (Mirai)", "value": "9f92b9028d08ae46523d34cde299c7df95478d23", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773001786, "uuid": "9c75ccba-71f7-4244-8f4c-662894ee6910", "comment": "Malware payload (Mirai)", "value": "700d04bd8799cea47ee2b6ee71966090c28ec1d39a5dbcda28248cfb924cdeb6b186c7b6b73edaa66d9fb8ab3b25f250", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773001786, "uuid": "cdac3674-8f36-406b-ad0c-bf06e9fbcf60", "value": "T15B242A42A551BE73C0C25B79BBAFC25537736B64D3C73302AA28AFB01F4669E0E2D115", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773001786, "uuid": "dc732b1f-8dde-434c-9184-6834a8a94875", "value": "6144:8Mza3MjXlE6aZoic4AMMMKgSPwYOz/FmW36iuZYZHjfpUj:ra3eXS6aZ/DAMaKFmW36iumZHjfpUj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773001786, "uuid": "2ea3b89b-e147-4fee-8800-a51e7199fbd8", "value": 227212, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773001786, "uuid": "81f55de6-8301-444c-828b-13d8ea241d51", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773001786, "uuid": "30fd6f43-04ad-433a-9c50-8d710285e854", "value": "a-r.m-6.dick", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3f8b8c0-1ae5-11f1-a769-42010a9c0008", "comment": "Malware payload (RustyStealer)", "timestamp": 1772970902, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772970902, "uuid": "a98135d3-fbdc-4ba9-a977-b6979ea2d410", "comment": "Malware payload (RustyStealer)", "value": "1e4f27363b801174b74d062f70e44f39", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772970902, "uuid": "27f753ed-09d7-4191-9c2c-311266ac9c88", "comment": "Malware payload (RustyStealer)", "value": "719eba524be5955b258a721bb879f4cff3296bad8178bdc6b612b109b28c6fa3", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772970902, "uuid": "599edd7e-95d2-4bdc-83cd-3b8abe9ac613", "comment": "Malware payload (RustyStealer)", "value": "40365034e7e2a2a7f86f0573ff154b024091ede2", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772970902, "uuid": "c647e525-80b2-41fe-bc6e-5f809d5dbd4e", "comment": "Malware payload (RustyStealer)", "value": "50e83a044c69a8da24939c7f59cccd2c8f2d59c23a7eb2032bfe7bff40df56eb847e969b5e2014de65b1325c5a8009c0", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772970902, "uuid": "c70b76c6-7155-4db3-8917-7147d33ce8e9", "value": "T1CE1628217F5999AEC05AC074C2878B726A3270CB0B35B9FF448496383F69AF55F3D258", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772970902, "uuid": "51649a94-04ef-4279-9223-b8bc5dd32945", "value": "98fc41773fa3dfd07c605c5f756de872", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772970902, "uuid": "7fff63ab-f948-4757-aabd-25b6649cf29b", "value": "49152:NPiKJgMO+YOADts0APwPjEfhMvJhNYfx9J9sPPmUaW1m3pYK20ltF9V2+5HrRPvw:TPdsch0kGu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772970902, "uuid": "4d6a93a7-7178-4ebe-bbbe-19defe3d2ce3", "value": 4062208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772970902, "uuid": "c02db575-542b-426a-9e89-30d9fb707770", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772970902, "uuid": "984ca888-34f3-44a8-b39e-3fc82220cfcb", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d3f9d9c-1abe-11f1-a769-42010a9c0008", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1772954033, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772954033, "uuid": "0865e569-f6cc-429f-b044-c8396fe6266b", "comment": "Malware payload (VIPKeylogger)", "value": "4e747a64fe1e08f0d5b78743c7077d13", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772954033, "uuid": "c6593dd0-f09b-458b-a0f9-25f762d818f4", "comment": "Malware payload (VIPKeylogger)", "value": "7547860f567f88ff064f34a6f2062c5b11768353ffdc5049bd13a3e1e633e379", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772954033, "uuid": "67ea6100-3915-488c-91cf-c3da1aed6319", "comment": "Malware payload (VIPKeylogger)", "value": "434d9f02f89529948d9db805736367c409ea35cd", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772954033, "uuid": "f18fcb24-1bf4-4be9-a7c0-8bfd57671dee", "comment": "Malware payload (VIPKeylogger)", "value": "0e6d9596a2333ec381f705e741f61f88eef5eaacc255f87e730401a15520e6df829a0dec963f3b7d09752fd2f961be07", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772954033, "uuid": "e3df09f0-a73d-4bae-912b-a93a90a3d100", "value": "T10D45DED02EA1C8A446FACBB9C47CA219CF71566361766C2B2C506AF90ACD3DF4117E37", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772954033, "uuid": "43290770-7d3f-4239-842c-8b7cd5c7373b", "value": "96:MpcssGSsQT7rLUcqZ1C7pWUrc197UHISUcwcpqIBUBABozUcwcpqIBf4lcspcsZo:urTr4Pvyj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772954033, "uuid": "4c7d25f1-3c6d-4d23-a141-d3da335a5976", "value": 1214651, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772954033, "uuid": "29654143-4fe3-4f55-ac10-4c85d46c14c9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772954033, "uuid": "1f4c8ad9-db03-454a-a8f1-42dbca61bec8", "value": "4e747a64fe1e08f0d5b78743c7077d13.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0a8f2f5-1b46-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773012611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773012611, "uuid": "6ee7020a-fbf7-40cc-baf5-1db4040ab21c", "comment": "Malware payload", "value": "a63c3b2d3a9fba4ea14c0b02188834ff", "object_relation": "md5", "Tag": [ { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773012611, "uuid": "5397f021-647e-4bc2-8278-492f4f848c4d", "comment": "Malware payload", "value": "76deeeb07d0d5fcd64fb5bf50945b288f31852baafe3df0069aadfa70bac7f54", "object_relation": "sha256", "Tag": [ { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773012611, "uuid": "e353e882-fd03-4377-9a45-54d9d103f294", "comment": "Malware payload", "value": "053ff586b7c73ba0095174a0dbbfc446ac2bfbe2", "object_relation": "sha1", "Tag": [ { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773012611, "uuid": "95d2433a-abcd-4d27-8e74-d423862eae8e", "comment": "Malware payload", "value": "233856c001ececf9b557981048b9d95ace153fee3aeeb06f47023dbcb23cd934bc1122d3970debeaf1a06049a965b0d5", "object_relation": "sha3-384", "Tag": [ { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773012611, "uuid": "d9abe195-6ea0-4bea-8063-7c6df07aea34", "value": "T1089533104256D345DC2CE17D8C2269831BDB79C2664D86594FCEB3E3F4C83B25A7A9F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773012611, "uuid": "9b871d8c-114a-4fc0-96d6-99ee80d215a2", "value": "24576:zAcq9hYeshGVn7AKsGnfFKqBmAwFZIGYF/0Whyy+GZMW8FdFcT7A0hw2GtQvgBsp:QDYnhGdDkAwFi7/0WH+aoFdFAD9eI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773012611, "uuid": "586986c8-7dcd-4419-9c48-e33181a4e9b7", "value": 1905405, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773012611, "uuid": "28c50bfb-833c-4e45-ac20-5dea6d5a91e4", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773012611, "uuid": "6a9f0ef7-d90b-44d5-b046-83c5427da089", "value": "nOutstanding_Payment_4536209.r00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8d1c46f-1b2d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773001915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773001915, "uuid": "d91413ba-48e0-4336-b0b7-eb3ed32c27e2", "comment": "Malware payload (Mirai)", "value": "1592eab0447b7ea9946802cb961e29a4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773001915, "uuid": "15bbc90f-0a1a-459c-8e0a-3e0a9689d876", "comment": "Malware payload (Mirai)", "value": "76ed4a7b19eb775dc5c0dc1972249303575928f25f683c3810662703757c7daa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773001915, "uuid": "da2ef88d-2af1-40df-8d4b-bc302c964e3f", "comment": "Malware payload (Mirai)", "value": "77c0029ed757016c87509e09f7f2bba14a69aa34", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773001915, "uuid": "cc8cfac6-cbdc-4ed3-aa03-f53aea6141d5", "comment": "Malware payload (Mirai)", "value": "1ab5cc929cd349f47ec16552cd14f515465c5f84f3b500c25620aae1a80b8b8d624d5d9185df06e3683b12d69811ef95", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773001915, "uuid": "32455e70-9cb9-466c-8fba-c205b5716ccc", "value": "T1B1B32859F881AB12D5C625BAFF4F419833530B6CE3EA7212DE208B3533CAA5B4F76511", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773001915, "uuid": "b56feb00-c7cb-4ba7-b516-7a7ed5cf1e91", "value": "3072:0NAkHBoN3lAha+xO2qxdimTUfjcq8N/iBg:rN32ha+xO2qHimCclN/i+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773001915, "uuid": "4853d45d-8b54-4a5b-a215-7aa9bbad075a", "value": 117396, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773001915, "uuid": "355556bc-3a2a-4b67-84d3-0c1cc0dfd27b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773001915, "uuid": "4635fec5-8ea8-4e40-ac11-8e9a227a1b4a", "value": "violetarm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f17ea9f-1b11-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772989658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772989658, "uuid": "c0578cd6-a661-4cfd-bc56-2d895915cea9", "comment": "Malware payload (Mirai)", "value": "bc2d1910899b744c59720d9754968703", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772989658, "uuid": "a6a3833d-c1c2-4232-954d-78f43c2b904f", "comment": "Malware payload (Mirai)", "value": "77e0d2b04a35396502dde3159a66a08ba846d129d964f7ab93f0161e3292f899", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772989658, "uuid": "187797c0-743c-40a8-8134-8c5c54a6f898", "comment": "Malware payload (Mirai)", "value": "6cf0b35d466d3ad5b27c9fb1fad66a226b6787fc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772989658, "uuid": "56745d52-ecf5-4225-b402-ac7863a3217a", "comment": "Malware payload (Mirai)", "value": "0228280a96bf3d67be94fe5fb53b94e97758f23566783d8386b59c1c7b5b9057d5df8b76c1434c119d7f4dd5ec04f327", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772989658, "uuid": "1433a376-3e79-4369-af43-00947103e387", "value": "T1FA453332C7E02346516D99B3E4572FBD9A62C1E8FF54CF914028ECBF174603CD8A5AA6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772989658, "uuid": "8c93241a-3890-47cb-a742-984d28c5141f", "value": "24576:h0yecJ47n46yH/9/zPAd3+pZn308JbqelII+KiuZOLmp79gjYWg:hNem47n46Q/9/cGn308JmydgDLQ76YWg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772989658, "uuid": "770f9c51-4a7c-4a95-8209-01570fb6e7dc", "value": 1195384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772989658, "uuid": "025529f7-e9a2-448e-9d0c-15e94e8049c4", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772989658, "uuid": "25a9167b-03b1-47c1-b2a1-aaa540d40546", "value": "armeb-linux-musleabi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3492c09-1b29-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773000241, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773000241, "uuid": "c046b32a-260c-4beb-ac1c-a76b1ba2cdd4", "comment": "Malware payload (Mirai)", "value": "92eae75abef22bba5e41632b928eb753", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773000241, "uuid": "8907d347-77d1-4b46-b5a1-7ce93864a587", "comment": "Malware payload (Mirai)", "value": "780a7652b7564b1dc94e77c7cd921b2f2e482e37ff00dbcbd57d3295103be4fb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773000241, "uuid": "7c00a2e8-3631-4376-849d-0aa905eb8be7", "comment": "Malware payload (Mirai)", "value": "4e56266ad58abed3aace4b2040e33bf2d6fee015", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773000241, "uuid": "44356906-0be6-4c7f-b60d-ff0697a1818e", "comment": "Malware payload (Mirai)", "value": "87efd89355b29e6d93c843f5ac4f55276f0cbbe82f0d1b95242d3d5710219ffb66755748ed1630128ce2b97d146ac60a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773000241, "uuid": "e86b3852-73cb-4f38-a868-e5fa8962ba49", "value": "T179A31A46B9415F12D5C721BAFA9F414933536BF8E3FA7102DD206FA033C699B0E72916", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773000241, "uuid": "ccb015df-9425-4f45-a75f-3f08e2d05b2d", "value": "3072:OJKEgKcbOWvC+a409qIcEUYo3BURYo+P+:OJKE8bx6+a409qIcBYvRYo+P+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773000241, "uuid": "fd830ca7-b11d-4494-9f3c-bfad6a757277", "value": 102040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773000241, "uuid": "44a6f48e-b1ff-45a7-a448-660880e81ba8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773000241, "uuid": "def0f672-7e27-4b57-b3b0-fa16fe58d30b", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f4df585-1b11-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772989712, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772989712, "uuid": "18b95abc-1754-4cc5-879b-be10b3a8575a", "comment": "Malware payload (Mirai)", "value": "784cbc181e9aac027f563bd530f2cefb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772989712, "uuid": "6b198e80-364e-4cec-920f-677615d057a1", "comment": "Malware payload (Mirai)", "value": "798dd77b4f39bf692e5aa01414f442c85d2e08665c502ce9b5df7b0c536d1926", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772989712, "uuid": "3eab1efe-e71f-4801-ab45-bee1f2e2a049", "comment": "Malware payload (Mirai)", "value": "5fb13bd60808f3381dadb0a09ca1e19d3e2fb1d6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772989712, "uuid": "ff8da473-81e2-4129-bedb-a110ffd75ea8", "comment": "Malware payload (Mirai)", "value": "94bf8dbe9b35fec933b7abdfbf015f13d49e4a82622067eeadcf179142e0097062b01aa994e40cfc094d77297873de1f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772989712, "uuid": "b69f5811-8fb8-4eb7-b689-33b614a5d22c", "value": "T1FDF53A62B892DE93C6C05675BB5DC2DC7B175B34D2EE3206CD0443283BBBA6B097B152", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772989712, "uuid": "67900dc6-5fe8-469b-be02-7a456155d9a1", "value": "49152:ZtXckDLVtNsPcrU1qLdZqyA5FuTgHr+NOWCQPA:ZNfptNsP70ZjeHFWCV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772989712, "uuid": "cf066ff2-a2e7-4b31-9f33-6aafaee20253", "value": 3545444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772989712, "uuid": "2e02765b-8561-4032-9d00-f4e31ba2ef7a", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772989712, "uuid": "349dabbe-5c55-48b0-a875-f8007e629bd8", "value": "armv5l-linux-musleabi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6db4f252-1abd-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772953631, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953631, "uuid": "d8d03df4-87fa-4f0e-b75e-2d1b9d99db19", "comment": "Malware payload", "value": "5fb3db1501e9be79af827e353fc0f178", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953631, "uuid": "e2bae331-30f0-4af2-a83c-f51c82795730", "comment": "Malware payload", "value": "79a4a96cda716df66866901f052b434bcc888470ed0958059a96c54527e4f69c", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953631, "uuid": "f6b0f6aa-1011-4426-a83b-339fea3a63f0", "comment": "Malware payload", "value": "20dfbde3ae0e26fc4d6abb8201bac859abe808f8", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953631, "uuid": "1950a572-0a3d-4cd5-adb1-b19f28658790", "comment": "Malware payload", "value": "bcf5fc8aa79447217840cb188016917092e0daa6ed7f9e7d04ef358eaf2e70a6e7e055dd0370024ea6de066681826056", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772953631, "uuid": "3238c7de-6771-40e4-bf48-4157f97f18b2", "value": "T18945C709798B63DEDF691C1DB632CB6C171D3A9B90896D74F6F3D1306AF6C4C0862A90", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772953631, "uuid": "9362bc7d-c7e2-4708-a7c9-80c11ba25549", "value": "192:IWqQotAtOZqrqvRR5qOZRRK+ZRCIZOZVqORlVqmqLL6w4RRW8r6o6gLa5juatvI6:xE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772953631, "uuid": "98415a95-83d2-43b4-bc98-3d614481a4a0", "value": 1222767, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772953631, "uuid": "2b8513ff-466e-4eeb-801e-c923306cc629", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772953631, "uuid": "5f35adff-65d7-487d-b24c-36c041fed9c5", "value": "5fb3db1501e9be79af827e353fc0f178.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4969fa1d-1b11-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772989648, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772989648, "uuid": "a888caff-dce0-4894-8307-1db05043edfb", "comment": "Malware payload (Mirai)", "value": "26f40cf8b246610515102e2c7a4fad3a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772989648, "uuid": "cc201288-4854-41b4-a4e2-9349cd2ae7c5", "comment": "Malware payload (Mirai)", "value": "7ab73e8854911ac8e15a557d7337566b0e88cbeb7a6940263a59b0c3cd379ea3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772989648, "uuid": "ac3cdeec-1dfe-4080-b5d7-8e0358077ac4", "comment": "Malware payload (Mirai)", "value": "79b52f357616fe85c88497a4ba2da963c7c0b35e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772989648, "uuid": "6127a17b-b344-46a4-b2cf-e0d17d4f3165", "comment": "Malware payload (Mirai)", "value": "306d46afbaed9c3b9f21ca916b513a47562e32073ddedc4b3590e76d4f0478911c9e048b03b08a26a386a63cd21d9a80", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772989648, "uuid": "4a0495b7-ce97-4412-9ad1-682769c008be", "value": "T12E4533CB2C56B99618056CF6FBEC2D165CC294A130BCD02EC2869465BF3EA45FE41CE7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772989648, "uuid": "fc0c17e0-2832-4c87-b358-ba8b907eb46c", "value": "24576:NQOEf6hP95dfuWM40HDIQN1c66utnuAaOMKnCoZwrAEmf3ocIzQ:+OvbJiHDR2utuARMPDbqt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772989648, "uuid": "f04eb5f2-288b-44c5-a66a-25c1f75412ba", "value": 1208428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772989648, "uuid": "5ec5c3b7-284a-498e-b857-7606d3ad170f", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772989648, "uuid": "c9663b3e-17cb-47ab-99f1-1420921bb660", "value": "armv7l-linux-musleabihf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e1cf306-1abe-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1772954008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772954008, "uuid": "d90dc8bf-d753-449b-8e20-997edbd7acb4", "comment": "Malware payload (AgentTesla)", "value": "3c4eebeab983176cff5d2fd5ff85333d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772954008, "uuid": "818a59a7-51a2-4734-9afc-d1007c702110", "comment": "Malware payload (AgentTesla)", "value": "7ade07935b318315d906853f7a1b4e080fb366a3142da07cc972fba54069bd92", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772954008, "uuid": "0c1871f8-fc3b-4312-a93e-2fc0886e520d", "comment": "Malware payload (AgentTesla)", "value": "2c9182eb5cd9827943d61ec8c2d18a6b42f72057", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772954008, "uuid": "20b89224-2fac-4696-bae4-997ee901b844", "comment": "Malware payload (AgentTesla)", "value": "38b71534c959354429f31af08e3471a71a3508b51b47da580299f977a3b932e3053987820035fa800dd4884ab88f4c3c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772954008, "uuid": "d1aa8b68-72bf-4290-b668-2294affd2bd3", "value": "T104D2238C7FC7B0A60A417837292F746EF33E9C41A4A8D0D4C6D624A8F428B95C5F6E75", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772954008, "uuid": "4b031cfb-1f69-48d2-bbfc-e9c05822944b", "value": "384:9sq3sNXaqjRyYWNwCUc/y8gpvMtEIWS7sRIhsDoKCOWtQ6JIBaZIhRm/i/4Hmp4X:9JsNKARdcq88HIHzXagmRyX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772954008, "uuid": "49a13d56-902e-4990-b0df-b21e8378b316", "value": 29490, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772954008, "uuid": "35ea2973-f18c-4142-afbb-8dcc73b88b40", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772954008, "uuid": "3408a922-0bcb-425c-9b6b-41e551ce8b41", "value": "3c4eebeab983176cff5d2fd5ff85333d.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4cc37c38-1b11-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772989654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772989654, "uuid": "d8798e7d-d463-4345-95fd-c0a88da4c2ac", "comment": "Malware payload (Mirai)", "value": "89d809c2d3988a540198115a37d364c2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772989654, "uuid": "cd82c560-72fe-446f-b08d-71f51e6edec4", "comment": "Malware payload (Mirai)", "value": "7c0204594050e101f1c69985397c31f783347b8cc0aca0290958997de982fa9b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772989654, "uuid": "803e3df9-6c34-4a5e-8134-88fe5332172f", "comment": "Malware payload (Mirai)", "value": "ad9422d7169941b03d927641e3f30161364dd9c6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772989654, "uuid": "98c755ae-ce02-4920-82ad-8ea09f65cad7", "comment": "Malware payload (Mirai)", "value": "bc9f144f294d63667dc5da6dd0555039c29044a118cf6dc0630c27a8e491cb9da98103996a933d5d9cda049ba2ea548c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772989654, "uuid": "2c7a1b71-f6a9-424d-9a51-ea59d4d2a316", "value": "T1A44533F036C31B68D74E2AF26AE1C5530521BE64D7949627DB9378DC308179CAF36CA2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772989654, "uuid": "773b3f45-e830-4027-a6df-6c19b0897b4c", "value": "24576:r4iDyYF2FAxqYM5uMXXMUm1BQn7Asu6aOD20cXYkJ7EL3ukJT:r4iDy9CqYM5tXMUkBQECaOPdOQL3ukp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772989654, "uuid": "bd6c8292-fe48-4784-8914-3454d6cf4bef", "value": 1205200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772989654, "uuid": "d2fc4021-a2ad-43a2-a490-4656c101a3e2", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772989654, "uuid": "f1caceec-8319-4eb2-8bcf-cde78361c2ed", "value": "armv6-linux-musleabi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30d5e7a0-1abc-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1772953100, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953100, "uuid": "feaf44a8-f11b-45a1-8159-4bcc9ee6215a", "comment": "Malware payload (Vidar)", "value": "40d2082d7177c0bff19ebf0415af1da0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953100, "uuid": "c64de28a-4647-48ad-9d49-57de5c558e02", "comment": "Malware payload (Vidar)", "value": "7e1f3c8af73a8faa59ffdcdbff3063a6f7d2c038c295bd862f8b0e98c1fc6811", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953100, "uuid": "ab877b37-2107-4497-b35f-4293aaea2666", "comment": "Malware payload (Vidar)", "value": "b4bafe0498d7b25e349d2a8ae2e1ca891a9893f7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953100, "uuid": "8e911bfc-7c6d-4bbe-a3cc-39306b626712", "comment": "Malware payload (Vidar)", "value": "f41c062d47ee513e7a7bf463f2955628cf681cdf8b707027f432bb39674ac6fda7cdc57307738e9ce8eb245e223b36a4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772953100, "uuid": "5893a8a2-8984-4cf5-8a43-a70459eb35db", "value": "T1D89608EB6265C1E9CD19C13AC7938F8096F371771732FAD712A243A89F025C65E3A634", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772953100, "uuid": "2148ee17-4250-4fce-adcd-8abc6a310fb0", "value": "2929b387c156d33bcc782c815d7103dc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772953100, "uuid": "344781f4-134f-428e-82a0-7c9d6ebff518", "value": "49152:/rsLnRYcURO6k3uYiOg4wive0dxVS1DBOrj8KVtUcssGF/GWyBITuBPuGjQx9Psc:/wQCjCTSwGjLzT9k4r0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772953100, "uuid": "be238beb-1313-463a-b8da-fa77ea67d6e0", "value": 9219584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772953100, "uuid": "7ce1683b-f630-4291-91b5-cda8b8664177", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772953100, "uuid": "c4d68b8f-6037-4712-8b04-4fba4b73f716", "value": "1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "889f9ec4-1b2e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773002209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773002209, "uuid": "4d5ee246-efde-4045-b8af-ab1eb8b771d6", "comment": "Malware payload (Mirai)", "value": "d789251cb2f676b17ff9c96a7943fe2b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773002209, "uuid": "c47e51be-ca5a-448a-b8fb-8dc00e0162b3", "comment": "Malware payload (Mirai)", "value": "7e2b50a083ca8daf10a737d71442032104cea29807531cb47ddf81c80c4f9330", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773002209, "uuid": "fa6178d7-e6e5-45c2-b4a8-1f59485e03ea", "comment": "Malware payload (Mirai)", "value": "095fa0d7243af5b153e93adb92770884bfdd6a3b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773002209, "uuid": "a93d5af8-123d-4ad5-bd4e-818d37f89f7d", "comment": "Malware payload (Mirai)", "value": "d1d6a092c4593010ae52043021e5dbba391b783a4c4d97d9df90db273351c0fbdfc078d7df0cc6a6bda6a40f7dbb88fd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773002209, "uuid": "1f65e09f-c55f-484b-b607-1a06955c384d", "value": "T119932A91B8819613C9C556B7FB2E425D371603A8D3EB3203AD248F71378E89B0F7B995", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773002209, "uuid": "8a6c5084-b011-4e92-aafe-a4a8b2bb33f0", "value": "1536:Q3ZqSVl+GJKir/8gnFXX36oqokAuNGXSzCK5OxpJC1fN3ROOktWe7c:KcGc81/8gnF36oq7AuFAUF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773002209, "uuid": "980b85e4-de50-472b-945f-471f668387fa", "value": 95568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773002209, "uuid": "fe00b39b-d6f2-4017-bfda-49a6ef781db0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773002209, "uuid": "81382f9f-fa5d-4c52-a7e2-eeb45000d3d3", "value": "violetarm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46ed983d-1abc-11f1-a769-42010a9c0008", "comment": "Malware payload (CryptOne)", "timestamp": 1772953137, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953137, "uuid": "61163cff-5733-4d97-9736-51cf35686a54", "comment": "Malware payload (CryptOne)", "value": "e1dc65079d0578067a9b3050e4d5935f", "object_relation": "md5", "Tag": [ { "name": "CryptOne", "colour": "#62260A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953137, "uuid": "8502cb2e-2787-4b2a-890f-7ab981a7e073", "comment": "Malware payload (CryptOne)", "value": "7ea7ae9a058e06d383849eadde729e160019a3ff54f41bc87e615ecaec06adef", "object_relation": "sha256", "Tag": [ { "name": "CryptOne", "colour": "#62260A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953137, "uuid": "9c0d54aa-04ff-4373-aa0b-5acedfeb733e", "comment": "Malware payload (CryptOne)", "value": "982bca9aa2a552653f9e84946d50197cf5a1451f", "object_relation": "sha1", "Tag": [ { "name": "CryptOne", "colour": "#62260A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953137, "uuid": "eaf345be-76d2-42fb-93ad-9fa96f9224cc", "comment": "Malware payload (CryptOne)", "value": "ebeb060f8f9e197cc0d9039772ea4a08127fd4c5d8c06b23ab1645c222505427f1b1a2c210b837aae1acdf338073e3c3", "object_relation": "sha3-384", "Tag": [ { "name": "CryptOne", "colour": "#62260A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772953137, "uuid": "2f5c6b74-5692-4d1e-8944-b738e7cc45ba", "value": "T16A4601A688746021F3B364311B92BA59F425381EFC217D0B25D764DCFB3E7EAA061772", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772953137, "uuid": "73f4a3f4-c07f-4e1a-b5da-7b9bfb209c88", "value": "e8450cd9fde12fe86ba788a327b66219", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772953137, "uuid": "b74cae64-58d2-4509-a0f2-f520c752ae43", "value": "49152:mxJ0ZCwjBx9Gka5+q/tvo64ztvnt2U6MD2MuoXoVYqAOs7/gVfjPmFuoOsttg6IL:mxJ0EAtGdfo6etfD/uoJ1gVbPmFuoX0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772953137, "uuid": "9258a14c-48bd-49b5-b415-6fbe1c6c2ff1", "value": 5661184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772953137, "uuid": "60e5af79-7ff8-4160-b1ed-6bc38c7a7787", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772953137, "uuid": "09aa6161-b786-47c8-94d6-052d3fca31a5", "value": "2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70ad98c9-1abd-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1772953636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953636, "uuid": "38d90797-fe32-4f6f-832e-70eb5bd4ffc6", "comment": "Malware payload (AgentTesla)", "value": "016d36d2ad3625ab82dccbdd7314e885", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953636, "uuid": "0698d413-31c7-4ebd-8a07-f7de2b567334", "comment": "Malware payload (AgentTesla)", "value": "8032844e7fbbaeda4e320905848db8a66c1a20204ffc80ba1c2d0d5d710f276c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953636, "uuid": "ce6e5a4a-b40d-4757-b4ed-4ae3e37374d6", "comment": "Malware payload (AgentTesla)", "value": "230a1c12d29227878e5ef838c1691047ec9ab376", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953636, "uuid": "41a926fe-5032-47ec-835a-6685b0c4764e", "comment": "Malware payload (AgentTesla)", "value": "46aa2e285e4e765b4cdfbe9b1cd1d58595ea94f4dd0046396bcc9e2310f9acea7b56971cbe6d7eeeda796ed77664d744", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772953636, "uuid": "1178cde3-5cae-4ae0-811b-49e831113779", "value": "T1D0838374194C45EF2493EAB4B088A7E3FE6C0A5C9FFD664F525487CA163EA8734839C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772953636, "uuid": "e4f28ad8-b430-40f8-8d2c-48d516edab65", "value": "768:KmfSQeD97IdzImUQ1xPlRl2xwvLeisM1mKPMnsxusoWH8IPbMzDl:KM08lHvlXv1XCodLcobMzDl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772953636, "uuid": "89601977-fb1d-45a3-a68d-2c12ea87590c", "value": 85022, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772953636, "uuid": "491e9da2-3580-4cbd-8a14-b5fb96417bce", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772953636, "uuid": "5707f78e-ad52-4276-872c-2c748121f3f9", "value": "016d36d2ad3625ab82dccbdd7314e885.vbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cbf92f9-1b22-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1772996848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772996848, "uuid": "4453cbac-9ecd-47ae-9e2b-697dc66d1d33", "comment": "Malware payload (ValleyRAT)", "value": "ca37c82b59ce7fee7be80a02d253a521", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Script/Wacatac.C!ml", "colour": "#F2051F", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772996848, "uuid": "c37f51f3-618d-44ec-845c-dc3b9bc23e24", "comment": "Malware payload (ValleyRAT)", "value": "810e90336d4a719bb885e7fc77de370e5d69987d95988a8f8a354a53c88161b5", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Script/Wacatac.C!ml", "colour": "#F2051F", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772996848, "uuid": "fdb2e554-b646-45b3-929c-2a078d33b083", "comment": "Malware payload (ValleyRAT)", "value": "91621739281c7867351bbca03b68ed821359a6d6", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Script/Wacatac.C!ml", "colour": "#F2051F", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772996848, "uuid": "cc160631-71ea-43d2-917d-28f10692f755", "comment": "Malware payload (ValleyRAT)", "value": "9d26b92ee81f883b5a5c11323db5167688009d286f0153415216f6154c420ed6fb9d63c720aaf0627ee55f0fee1ea234", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Script/Wacatac.C!ml", "colour": "#F2051F", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772996848, "uuid": "5c8022dd-c11f-47f6-b8ce-fc469e3be3e6", "value": "T193183321B566A9B5E72FA37FA0A4DF5950317EE03337D5D723783BA64AB058220B1D03", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772996848, "uuid": "5be8aef2-7798-431b-b778-37f1b6dd932a", "value": "1572864:RyGVjCC73BtadVi/ZGDsVp+xi+5E7fpAUf+Pb6s7/LBBtYHgWMB6nJoFd:npCCbB0dRDOwa7zyus7FnBWMA2Fd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772996848, "uuid": "2e0e0105-27d4-4c0a-b604-62a04bb585c9", "value": 87337984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772996848, "uuid": "c337df5a-fe62-4855-bf59-a9eb12a674e5", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772996848, "uuid": "7f00b8cd-d4b4-46a4-af07-a6bcce6b4562", "value": "ChoneSetup_lkgoojnb.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb05174c-1ae2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772969733, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772969733, "uuid": "904c7e97-5580-4d9f-834a-0bf81d9b1480", "comment": "Malware payload", "value": "06b9483a17cdedb6f987e7b037137d1d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772969733, "uuid": "2f135407-e617-487b-9509-684c5d974aa9", "comment": "Malware payload", "value": "8196b3c51e5b6519e101a5a3e8df77435ac19e9d58bfd9cbaac4b03492abc79a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772969733, "uuid": "7a7d08be-4d3a-41de-9eea-cc6d316c5b79", "comment": "Malware payload", "value": "59dc8dbf2d588ae33366aaa4f3c6c0e1701e0321", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772969733, "uuid": "0c97f472-df9d-4d80-b8a8-bbce414556f7", "comment": "Malware payload", "value": "e31a9713d0b727478d0f7d4ef525d8f55856dc0d8e96fb80d2d39c23ed1320933939eff889e51cdf342dcddf9b80318f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772969733, "uuid": "18de6a54-74df-4562-8872-de71920ba22d", "value": "T1CED7334DBDE38438EA186B3AEC869D113C921A6D4BF551DD1D39F92C267CF0292B7231", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772969733, "uuid": "5cb7e728-681d-4157-8df6-fed47010b7a6", "value": "20dd26497880c05caed9305b3c8b9109", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772969733, "uuid": "8a8c8d5e-c185-487e-a47b-9055e276d63b", "value": "1572864:wC7UuGghkcDpOblKxm8o7EonKi1RAy8GDeqH:JQuPScA4g8Ghn3Adgl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772969733, "uuid": "66509b55-b6f3-433e-b077-4e2bdb033df9", "value": 62033448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772969733, "uuid": "8ebc9e8c-50a5-4b4b-a46a-a9c187725006", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772969733, "uuid": "feed0eb2-e9e3-4b3f-9680-20c48b8ddf95", "value": "Clearl_Ai.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58901a45-1b30-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773002988, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773002988, "uuid": "d9d9120a-e43c-4713-85b2-051dbd98785b", "comment": "Malware payload (Mirai)", "value": "348e29cebdccd01f98b174b12384d8ca", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773002988, "uuid": "368ac026-5d45-4882-8d54-8cf74bb65896", "comment": "Malware payload (Mirai)", "value": "819fd104b07c19c1ec5c83727a7187b90632019a1d06117d6906879bfa3f81f1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773002988, "uuid": "f25941a7-fcc3-4a82-a74f-5583614fe707", "comment": "Malware payload (Mirai)", "value": "81f5307532010f2c143f5702f15f8a06fc5fb58d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773002988, "uuid": "79498054-8904-4c75-b787-20b5858c1cd6", "comment": "Malware payload (Mirai)", "value": "c44d128ceddf0a5672871ca99540d181b998c28cf03dd05edf89139c90158abf56f44c75207097848e7e337e8434e385", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773002988, "uuid": "97a7b65d-bebc-4dcf-88cc-8c141bcdd2df", "value": "T14BA34A237A324D3BC4C0A13632E75326F9F643DE51B8961EBD701E8CBB69650321B7A5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773002988, "uuid": "b99db722-e010-4adb-a42a-0512878ba21a", "value": "1536:ZZVCTO1tWll6v3WgtWIzkUVbtVEo75K00kyStUyGe7ya:Z46OodbEoV3Sa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773002988, "uuid": "b08de5f0-c3dd-48d7-bfb2-e312322badb9", "value": 99684, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773002988, "uuid": "7c9633fe-7d52-4b78-bff5-bd728c32a2ab", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773002988, "uuid": "97c9e7b0-9c73-4109-bfc8-14501846c60a", "value": "violetspc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01f584c6-1abd-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1772953450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953450, "uuid": "436c4c5d-b42a-429e-a022-9d3866c19298", "comment": "Malware payload (AgentTesla)", "value": "97c07ee31af4600d8099a7d08286175c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953450, "uuid": "480a464b-21ba-4ea1-bfe3-e2a2b63732c4", "comment": "Malware payload (AgentTesla)", "value": "82d89601467b254e91eb50a3db1391620f29fc9299d2e34435a4e282ee9a6a34", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953450, "uuid": "c8a159ce-a0b0-4869-8fa2-c6d95821443e", "comment": "Malware payload (AgentTesla)", "value": "e0efe77dd1f2716005899dda7952c8e617450ba1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953450, "uuid": "3b10ad8f-d847-47c1-8314-1adc5612997a", "comment": "Malware payload (AgentTesla)", "value": "bbdf5fda1449e38734f76d05b2b9c05834fae4807e7a6399bb1547a67bc0ad17a7821654ebc342da3dbd16609f8078f3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772953450, "uuid": "2bb0ce0e-b9db-40e0-938d-2cce8a8eee36", "value": "T1C7558D18241B2317DE21E79471EC752045FA9AD93957F772CEB67AA71EA7AC0083F0B0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772953450, "uuid": "78297ae0-ca66-42f1-a5f2-26e1b9b96725", "value": "24576:UsUHB/xT4IMtfUPzvyduLGH4J5wjRZd6j:UsUHnGcjydPHC5/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772953450, "uuid": "cc53ee57-044e-43fc-a064-056db475d9f2", "value": 1346556, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772953450, "uuid": "dade4a62-d516-4552-bef2-75a83fa03233", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772953450, "uuid": "7d7f36db-1466-46bf-ab76-38fef90efc03", "value": "97c07ee31af4600d8099a7d08286175c.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1922f5ea-1b15-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772991285, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772991285, "uuid": "d3f2f3e9-9e61-4104-8fe1-2aff5e7b946c", "comment": "Malware payload (Mirai)", "value": "866dbc310fa1865e19ab627764945c0b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772991285, "uuid": "40a93d0c-64a5-4715-a49e-1c955446221c", "comment": "Malware payload (Mirai)", "value": "832300543239f19ce411d79abf1c09907d43672496512c36aeecafa9323b5bd8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772991285, "uuid": "3afcc871-30f0-400c-95fa-cb955f4d9869", "comment": "Malware payload (Mirai)", "value": "cdde385d573c4c522677d31aec1e70b187787b45", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772991285, "uuid": "7d2e436e-86e6-431c-bbd2-c26aaa393c77", "comment": "Malware payload (Mirai)", "value": "d4296542889454250484e0add5c2156c12339e565d390caa083a7b915563ff2394980a19bc854abc6a40c4da2af1d0ee", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772991285, "uuid": "95b1c83b-3be1-46a2-84da-a313ae78ba62", "value": "T1F704B719AB510FBBDCAFDD3702E90B0139CC955B22A93B363674D528F54E50B4AE3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772991285, "uuid": "de5c2481-87ff-44be-be2a-dd907d1787d8", "value": "3072:nKpzG1eNkSfcQqmav8SqaRVlnYz65GVt:nKY1eNYQqmeqavlg65G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772991285, "uuid": "5b876771-4e9f-44a3-80bb-c8d0d7c90ef0", "value": 177760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772991285, "uuid": "952043e3-65b2-4273-9139-4af0a7fabb24", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772991285, "uuid": "e739d381-d09e-4668-ae64-3fe2e8e29b3a", "value": "main_mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8193ff3-1b0d-11f1-a769-42010a9c0008", "comment": "Malware payload (Metasploit)", "timestamp": 1772988116, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772988116, "uuid": "ae6994c1-6e6a-421e-ae21-99a189eaddd5", "comment": "Malware payload (Metasploit)", "value": "48d1a236d28cafa52ac65bc8ebae3a2b", "object_relation": "md5", "Tag": [ { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772988116, "uuid": "1b36775f-78a6-470e-b235-ea11212ee402", "comment": "Malware payload (Metasploit)", "value": "85835d3c2dcd78eb71b1f13c03ed8cf1e6bb73ab336aa395b16f771d6e14d09c", "object_relation": "sha256", "Tag": [ { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772988116, "uuid": "760dd8fe-954b-4f31-b21c-3ec54a475fca", "comment": "Malware payload (Metasploit)", "value": "f0105bb2ecffc73298e807f601056778f0330699", "object_relation": "sha1", "Tag": [ { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772988116, "uuid": "67083ca8-98d3-4e79-9dda-6d3c69dae00c", "comment": "Malware payload (Metasploit)", "value": "98e92cffe9c8fc05435a0c5ada977e64ac3ffc78fe51ace8b4113f1e65c291f2472c66e96d816f28cd8aa015e04de818", "object_relation": "sha3-384", "Tag": [ { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772988116, "uuid": "474744a2-38e5-4c93-92eb-a317156b4c40", "value": "T16DA1D9383AAF5A484CC30067BDB2A4C9AD442BB6D5EA6C00F0D5C055FDEF615C23BB94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772988116, "uuid": "7480c8fe-1238-4053-a738-e71fc5ba59fc", "value": "96:Q5g9d+FvvOmLmbMslf84D0lE0lLZ80lO0l60lXeOKPk9:HEvOfbMsOrXhd1xNKPs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772988116, "uuid": "715bddda-9020-4223-8030-dc1e76eec240", "value": 4672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772988116, "uuid": "2f7c35f7-9477-41fb-90c9-5c4bec3af9c0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772988116, "uuid": "079a3152-d2f1-48af-912e-b467ccd82330", "value": "payload.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8a60864-1b17-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1772992465, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772992465, "uuid": "d0724211-fc52-48e5-9f8c-adc2a453f3a7", "comment": "Malware payload (ACRStealer)", "value": "493cafc37ed735d12a6f27f73e454824", "object_relation": "md5", "Tag": [ { "name": "46-149-76-78", "colour": "#C728F9", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772992465, "uuid": "febaf28f-8e85-49e9-9420-ea76e2298423", "comment": "Malware payload (ACRStealer)", "value": "85b05fc23d2ef09685594ae422d8b9d5b7dcd0483c42430ff85dbea0d8549550", "object_relation": "sha256", "Tag": [ { "name": "46-149-76-78", "colour": "#C728F9", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772992465, "uuid": "daf4417f-3a4a-4c4e-b20c-a507389d16b8", "comment": "Malware payload (ACRStealer)", "value": "2c44cb1f3b7d2b5c64884db87e8ad3a3a93a3d27", "object_relation": "sha1", "Tag": [ { "name": "46-149-76-78", "colour": "#C728F9", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772992465, "uuid": "92816323-d0fb-4db9-b44d-10263c673317", "comment": "Malware payload (ACRStealer)", "value": "0da32cf24130618e3a304a5c4b7316ac4a0a31a890507c2fcbb62822f335f84e7786609e4b635180377b071c47aab42f", "object_relation": "sha3-384", "Tag": [ { "name": "46-149-76-78", "colour": "#C728F9", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772992465, "uuid": "70f63ad0-882b-4eb7-818c-4934a71b627f", "value": "T12C179D13ADD08635E19E12FED1FA2A1E99B88C060325C6E3558CB9D47F727D13A3A317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772992465, "uuid": "4db77f0e-9a49-483b-8d4c-3a0cae4bd8aa", "value": "0bf4447fda89303e8c2644bb6df92eb9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772992465, "uuid": "eca7a303-73df-42bc-88cc-6b062b1d3e4a", "value": "196608:DQke5A05AXFN3delxDtPAFGfcn+hr7LlQCxPbSOivvt:DYA0aFsDXcn+B7LlQC093t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772992465, "uuid": "7133f813-0ae8-4df9-96dc-b1620b0ac8ba", "value": 20270704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772992465, "uuid": "7aea56c7-c2e2-4291-bce9-5ced092871a2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772992465, "uuid": "b743d220-8a0d-4959-8f7a-6590d3df876d", "value": "wke.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09c54a97-1abf-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772954323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772954323, "uuid": "b1c4acf7-fa28-4a00-92f6-d499b4603c72", "comment": "Malware payload (Mirai)", "value": "2da9c2b10ee7df3f9ec8e2579521e28a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772954323, "uuid": "8a9ac1d6-c377-4dc1-b14b-f05d4b60fb23", "comment": "Malware payload (Mirai)", "value": "881266a03eb3331d0dbc10bfd4a0db2fe9fb272437bd29b74f37de9fd15ca2b6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772954323, "uuid": "87c15e85-3485-474b-a9dd-69f482239b91", "comment": "Malware payload (Mirai)", "value": "8754e988d5ba5bc13a88d2c3d43e511734031f60", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772954323, "uuid": "69dc3bce-c17e-40b5-ab17-40512364b6c6", "comment": "Malware payload (Mirai)", "value": "a881d1b1feb1226d5fd4453a58a34874e7b88510d4ee9efe7d9f221e867c5b9d3b1fa1ba1633e91841c09ad75b7d7eca", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772954323, "uuid": "ac8ae1ca-40b0-40e7-b81c-f902731de9e1", "value": "T144D35B0673180E17C5E349B02A3F17E483FEE5D121F4BA89691F9B6A4672E771482FC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772954323, "uuid": "d3a5ce49-fd70-461f-9c7a-dc3de7c63a4a", "value": "3072:oWGIf1/UwfhJdU80rdtbYUaDGMsMA9TKHt:oWxN/UUDGjbYUaiMsMApKHt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772954323, "uuid": "a5867585-f3d2-49cc-8ec3-39a8f0a7c0c0", "value": 134840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772954323, "uuid": "578e5935-e9aa-41a7-bcff-b6eccee5fab1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772954323, "uuid": "572c07b5-8bb6-4100-be1d-a82826df0604", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f389405-1adf-11f1-a769-42010a9c0008", "comment": "Malware payload (Phorpiex)", "timestamp": 1772968237, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772968237, "uuid": "44a1d77e-fa93-401b-8d54-5b2e4c2ee8dd", "comment": "Malware payload (Phorpiex)", "value": "ab4c961c766b8f6117aaee10f7b62c90", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772968237, "uuid": "ebeae9d7-1476-437b-819f-5bc02c687506", "comment": "Malware payload (Phorpiex)", "value": "893a81e2f683f925c895a56663cfb296b1f2a4073545253be8e33eada6c2d026", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772968237, "uuid": "408bf2b1-8449-4b55-8dbf-e32f20ebe8c9", "comment": "Malware payload (Phorpiex)", "value": "bb297acc2f8950e37d77cebd3a31238dc59b96f4", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772968237, "uuid": "fe9a4bef-ccd9-442f-87cb-78f370a14d9a", "comment": "Malware payload (Phorpiex)", "value": "f9c9a9106bafdd913eba8a6cefa407b708b2a1d73f78dba7b5213b74dddae2b90e9026773b7c8c9634c8ca06aeccfac8", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772968237, "uuid": "b7e95b43-d461-4a9c-91dc-4517fdbfd14f", "value": "T1F9F1080E9E524072D39E0EB01B6241858B7C056327C7A1FFFBF305C95BE52E194A32B5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772968237, "uuid": "5b56e4c0-fff4-41bb-aec6-8ab69f510435", "value": "61874f268238fc91dc015e907d098b5d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772968237, "uuid": "02044366-9462-4ee2-b311-c1e7495d26cb", "value": "96:zWNIRd+zQz/dtDHtl24eTNu8gaJzSJxGENUOT2qpiC7tCEIVf:zV+Ezdl24IYBxJxTNUOTtp/I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772968237, "uuid": "c9c5efd3-b4ea-47c9-8274-611cc893929f", "value": 7680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772968237, "uuid": "87490b4a-abfa-448d-8398-f1ee1d6d6973", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772968237, "uuid": "042f6fca-e17c-4f0e-8849-e8fec50e0d6b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5929ae9f-1abe-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772954026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772954026, "uuid": "6be4fcdf-7a50-4645-b3bf-4487edf65c15", "comment": "Malware payload", "value": "f5e2652cfd75156acdd8b4a4dc844f19", "object_relation": "md5", "Tag": [ { "name": "DEU", "colour": "#5920A4", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772954026, "uuid": "0907efd3-b60c-438e-8dbb-c938eb46ec9e", "comment": "Malware payload", "value": "8962089c5f5f6e7adb017d1f723b8dbc8490d65ed815145a4dbca2aaad818cab", "object_relation": "sha256", "Tag": [ { "name": "DEU", "colour": "#5920A4", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772954026, "uuid": "335a60bc-9336-4eaa-bf6d-ae7b77c7c8da", "comment": "Malware payload", "value": "95a7acfcfc7494b32c7a807f580a575b2aaac5d2", "object_relation": "sha1", "Tag": [ { "name": "DEU", "colour": "#5920A4", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772954026, "uuid": "afea4767-d43f-415e-bf34-76883239fb9e", "comment": "Malware payload", "value": "3a556ca4fe4a9fe3bd08db25a7ded09bc08f010455710e3ba996662376642d4a980d9f28c1fad22efe0e641f74256725", "object_relation": "sha3-384", "Tag": [ { "name": "DEU", "colour": "#5920A4", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772954026, "uuid": "41b32962-7d4d-46fa-84ab-77a51f563b63", "value": "T106049511A3FD4209FAF73F84ADB462655E36BCA2AD79D2AC1261004E4AB1F40DDB1737", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772954026, "uuid": "e1727040-8531-44c6-945a-bf8fa4084981", "value": "1536:7l3CEj2PU3CtvjJ6ZTwmONo8Clze6Z7Epxsrxb/jJ6ZTwmOy:7l3CEjp3Ct7J62mONo3rzrJ62mOy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772954026, "uuid": "eb52aedf-5113-4300-9a0b-7c40fabdc6f3", "value": 173386, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772954026, "uuid": "8b1acdef-0887-4c13-8989-4afc1e26a146", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772954026, "uuid": "1d74fea3-5050-4cbd-a636-d4a18c601d96", "value": "Geldstrafe-20260305-81800_PDF.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7575403d-1abd-11f1-a769-42010a9c0008", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1772953644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953644, "uuid": "6c11cd06-7736-484a-b1cd-fb86250a74f5", "comment": "Malware payload (VIPKeylogger)", "value": "50f1cded0fac7542aba571ba96067814", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953644, "uuid": "8d6464b9-5904-4b39-86e4-edb8bd2e8c03", "comment": "Malware payload (VIPKeylogger)", "value": "8985959c3f21dd569b24885b2e1724cf39d8c38f87d33a66b8369d15bd305391", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953644, "uuid": "b3d869f5-4763-462c-9e6a-2e6e868d70c4", "comment": "Malware payload (VIPKeylogger)", "value": "ad521ec0851d0cf69778f317f463d77e358aaa1e", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953644, "uuid": "43ff2479-54d4-4141-ac85-1c120315891f", "comment": "Malware payload (VIPKeylogger)", "value": "1ca85409b980c149f0c5668478701281e7f8838db479978d051ff78e6dcaf7d9eddbacda8ae3174fd40a19797a83a620", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772953644, "uuid": "79a15595-f5cb-4e84-98cc-434a6ba59970", "value": "T1BE6512DB5FF44BC4A2980C97FA0557D4E6D082D71BFF6043530A8E41D89C9C6A2F93AA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772953644, "uuid": "aef20805-f8bf-4d58-9b19-d4cc161f8d4a", "value": "96:A/T/T/T/T/T/T/T/T/T/T/T/T/T/T/T/T/T/T/T/T/T/T/T/T/T/T/T/T/T/T/Tk:lcnHZdoJx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772953644, "uuid": "e9b9fc24-06c9-4718-a7f5-ed400f047793", "value": 1432815, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772953644, "uuid": "e68236bf-e396-45af-b974-52eb76360b5d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772953644, "uuid": "b9d459e6-4485-414d-9cb2-ef0b75bdfa40", "value": "50f1cded0fac7542aba571ba96067814.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b39f5b2-1b11-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772989651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772989651, "uuid": "d58d347d-71d0-4665-9960-87eb817c29df", "comment": "Malware payload (Mirai)", "value": "b0db70371d71bc166d0f53d93ff24164", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772989651, "uuid": "ca838c71-90e2-4f16-9b0b-7ffb1bb73896", "comment": "Malware payload (Mirai)", "value": "8bc4f8778aad01cdc9a0b10fdad4da83e88926f2989ae8cc1bc3e9969c7f5963", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772989651, "uuid": "58c2d08b-8bd4-4e0a-8212-5e12ddc5830f", "comment": "Malware payload (Mirai)", "value": "6c11ebe96645390694125e8a7e153b6e01e90f8b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772989651, "uuid": "ffedb940-1055-4e43-9d6e-99ceefae4183", "comment": "Malware payload (Mirai)", "value": "42dfb2ab83f1769261a279ab525dbf149f1483dc708ae6abeba455381a86863eebc4a5646aee0630d4ad2a43c173815c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772989651, "uuid": "a2c11474-19c1-4088-915c-eed0894dc791", "value": "T1B64533EF882ED969F49F242F142502659DE4687FF08C263B6EF51BA6ECAB114F114F40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772989651, "uuid": "e99c1843-95ea-4a5b-8bf5-4b819a281a9e", "value": "24576:Jk5vEMyrc1uZIEuvoF3JKu4Ooa6XEz+pZatj5fsqzAgDbYpCIgcaf:JxMM71ugT4NEz+pZ4NbzAibvlpf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772989651, "uuid": "a53ea69c-4f69-490d-9d53-1b4df4114381", "value": 1205288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772989651, "uuid": "639f9b44-f669-45e4-a176-5c41530c264b", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772989651, "uuid": "0f971260-2e54-4c32-bc58-8c1b82f22b6d", "value": "armv7m-linux-musleabi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7544f9db-1abe-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1772954073, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772954073, "uuid": "b91e0a2e-7226-415f-b5e8-8da7271a8e2a", "comment": "Malware payload (RemcosRAT)", "value": "b08230ed1484aa5e2f617e786b35e20d", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772954073, "uuid": "f57be89c-5d28-4a6b-a5e7-c8bcf14b722b", "comment": "Malware payload (RemcosRAT)", "value": "8c8ebe91852d4be8c2fa98bc65dd0d029833fc8451e2a91689603b8d3a330199", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772954073, "uuid": "fe24567d-adf8-478b-a17d-c24890317631", "comment": "Malware payload (RemcosRAT)", "value": "77e3a047dc80053c496b948c3e618c9f29f673ee", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772954073, "uuid": "61f40721-bd21-4f6a-895e-64c44038f126", "comment": "Malware payload (RemcosRAT)", "value": "1f1d67ea824fe61794e6cde2222f8844b75d5c95cd944022e047549429b127ccba23cb9b5f5665befb4f39f2fcea46a7", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772954073, "uuid": "44e19251-39c7-4e2e-9de7-40b6e9c82b7d", "value": "T12D4503F6EADC111079E3DBA6EBEC3CE6BE40D6520D6D29C3588945D786B7F4E24810B0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772954073, "uuid": "11df673c-3daf-4940-9478-af2e6d88b5be", "value": "384:EJItwdXffMlMffTM8wffuwTffMOTww837OuOftwupwpMl3ftw7O0li8M8ftwplpf:qOBXNvDl2+P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772954073, "uuid": "01f06da2-3197-430b-9de1-e7e2eb7bce7c", "value": 1198124, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772954073, "uuid": "c2d1f08a-4272-4211-ac11-2f4a82696393", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772954073, "uuid": "cfecde62-334d-497a-a96c-bd6704fa8cff", "value": "b08230ed1484aa5e2f617e786b35e20d.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d9bbe72-1abe-11f1-a769-42010a9c0008", "comment": "Malware payload (a310Logger)", "timestamp": 1772954061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772954061, "uuid": "10903f1e-774e-4416-8390-8f93579babe5", "comment": "Malware payload (a310Logger)", "value": "16ec325c90beffc51272f99c622dff74", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772954061, "uuid": "f96acd41-8ebf-431d-b79d-f50295d28cb4", "comment": "Malware payload (a310Logger)", "value": "8df6779da9f153debfb20a223931c8036320bbb568bfe8af0ca64def826c166d", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772954061, "uuid": "797e8f62-e43c-4599-a1c8-881c1542f9dc", "comment": "Malware payload (a310Logger)", "value": "14c0446802a0596311db998e87cabf069e2fc075", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772954061, "uuid": "33465661-2b9e-40d5-a3f4-bf92c22f800c", "comment": "Malware payload (a310Logger)", "value": "f88b0a951bede573995a042a15b85719dd7ca6e12d7720c4e0d4857767a83e42af36564db15ed79ebf9b1e67987c2f0d", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772954061, "uuid": "ee481d16-0a20-4381-b218-e57ab07553c7", "value": "T10BC5BF108A197721DED58B0E84B4734F83F7F6ABB425A86804C72FA56DB7116362F3E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772954061, "uuid": "b7ed486f-0605-4796-b10c-c5a2d255e955", "value": "24576:kTVb4gUwwxbxjbaD/J289HNLVBnawpVEWVqPY8LPyg59+MeXlQRr0oFw4r5KVMTK:kRbFRDJ5xa8VnyquEXlQ9pUYsea", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772954061, "uuid": "8b9a4f5e-ce22-4ba6-bf5f-eac3508c7fa7", "value": 2694232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772954061, "uuid": "249ac5cb-9ee1-488b-9e29-f59439e44847", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772954061, "uuid": "f904d2d7-00b4-41ba-97a0-9898852246c3", "value": "16ec325c90beffc51272f99c622dff74.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "564d6895-1abe-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772954021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772954021, "uuid": "a0a33725-e5f3-44bd-98dd-ff5b402fbb2f", "comment": "Malware payload", "value": "cf66601254939ec3173baa35ee5c104b", "object_relation": "md5", "Tag": [ { "name": "DEU", "colour": "#5920A4", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772954021, "uuid": "d705f240-09e6-4023-bec5-683df680af33", "comment": "Malware payload", "value": "8e35b877739ed1b9153bbc9b4d2fb877cf067e696b0d6411b6021c8ac0f04504", "object_relation": "sha256", "Tag": [ { "name": "DEU", "colour": "#5920A4", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772954021, "uuid": "8d8e8222-d213-4fff-a4d0-630920e504d3", "comment": "Malware payload", "value": "6ab3d51fe2269b2d482961bce5b0490bb997372e", "object_relation": "sha1", "Tag": [ { "name": "DEU", "colour": "#5920A4", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772954021, "uuid": "1a91fef6-d255-479d-ac0c-76a7ae4a1de4", "comment": "Malware payload", "value": "7aa956b9f1414b4ce369887c7a42f0fe772979ff9c43e4bbb2f7932371804bef92ec5f1cde3dbb111e825c5864ac001d", "object_relation": "sha3-384", "Tag": [ { "name": "DEU", "colour": "#5920A4", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772954021, "uuid": "a99b1372-58d6-4253-86d3-7b2d19ff6e7d", "value": "T113148611A3FD5208FAF73F84ADB462645E36BCA6AD79D2AC1261004E4AB1F40DDB1737", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772954021, "uuid": "4096ad03-83ac-4dbd-8160-b3762cd03f14", "value": "1536:ln3CJ1ltQi3Cl9PthPcZXRRXRzzP0x7D7HLlo2IjvFmsmPjCySSieXPcZXRRXRzE:ln3CJ1Ii3CPPt5IxPo7HKwjCyb/IxPoX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772954021, "uuid": "26393e73-6ecd-4ab5-b355-e5ec0c495ac3", "value": 198884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772954021, "uuid": "16af4b1b-56c1-4758-a014-3e99b32394c0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772954021, "uuid": "353b1103-51e7-4d7d-90df-f9e0ce5c45ab", "value": "Geldstrafe-20260305-81798_PDF.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14e701b6-1abd-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772953482, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953482, "uuid": "1ee2bfe3-5607-434d-8c7c-7245ec3ff6bb", "comment": "Malware payload", "value": "f1b64b730ab66ea4dc3cb35cd40ca370", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953482, "uuid": "65a174a4-c5a7-40a7-bd6c-d2f1bbf94cdb", "comment": "Malware payload", "value": "8e50528cc74404f47377f47b359f650c14791dc04a93e61812a26178498a7637", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953482, "uuid": "91b3b4d5-5fca-4b6e-90a0-c7f754ea7547", "comment": "Malware payload", "value": "7a485d9c2f47b1778e3ccb86655748799d7de224", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953482, "uuid": "649c8d09-cf07-413e-b8b7-f0b84e4b0b62", "comment": "Malware payload", "value": "9665f632ecf9f122deee7992d414c282d097952a2e6efa7b5ee5a83445c997c04253e240907696caf9d9a3d803ba744b", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772953482, "uuid": "e6ffc23d-1b3c-4446-acc8-0e4e8f011688", "value": "T1AFB2CE1027F55309EBF28E3A68B5A3218277FC05E9229BDF5381154CA821111E87AF2F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772953482, "uuid": "292fd71d-5b5d-4ed1-a752-9f50515b4599", "value": "24:8DFoJCuesgUSgK0zgP8WYbCROAXWMrks2+/CWnvU7lEykHX44I0w4L4I0CWvfihv:84C6PBgxYuThrjv4lP63I9IGee", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772953482, "uuid": "ae456475-00f3-4e22-8b18-0b83c98befbb", "value": 23526, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772953482, "uuid": "11c92329-57da-47b8-bc65-d741f31769c0", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772953482, "uuid": "0304b567-6ddf-4f1f-a08e-9214087ef29e", "value": "@kontroliryet - full.txt.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "161cde8e-1abd-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772953484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953484, "uuid": "b1428a5c-d45d-4ce0-baf3-b2a2d680107f", "comment": "Malware payload", "value": "0a2055546baacfed97c4cd87f191666a", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953484, "uuid": "e0e9eeb6-bec0-43f7-a4e7-5f8f4d82f613", "comment": "Malware payload", "value": "8ec5cf4b793e2924f6f89c9d5a4f85c080c4ce6e09ffd05fbb0c535c3dc0aff4", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953484, "uuid": "7755c172-5927-4282-86c5-3fd90b7e8db5", "comment": "Malware payload", "value": "6f8fd0e3cbd2ad97bfe5de7dedcdae3ada1d7aa9", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953484, "uuid": "1776ccef-f672-424e-a2a9-61643c541400", "comment": "Malware payload", "value": "7a7951ff3a7d311c9463883c395b370cf267d1637ab936a5dfbc85a100e08afb44b63e88dc02c6515eccbbafb1bc92f6", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772953484, "uuid": "fb903fac-70c9-4ddd-a562-3d08c39a6526", "value": "T13302C01417F51319DAF28E3A68B5A3218276FC05E922DBDF5381554C6C25111E87DF2F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772953484, "uuid": "1cfbd70e-fe83-4cab-9ee9-6c95535ffb8a", "value": "24:8foJCuesgUSgK0zgP8WYbCROAXW2Y+/CWnvU7lEykHX44I0w4L4I0CWvfihCef2c:8qC6PBgxYuTdv4lP63I9IGee", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772953484, "uuid": "a08202e9-42f2-4d83-a306-1c2d84cf56c0", "value": 8520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772953484, "uuid": "0d06f1ae-6884-4020-94ad-a4e63960088e", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772953484, "uuid": "f54bd362-ee59-4d3c-a103-8f2dc72c6934", "value": "Mentions and related.txt.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2b8e7fa-1b32-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773004025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773004025, "uuid": "f1fd05ca-21aa-4e13-825c-ff1c7be3d779", "comment": "Malware payload (Mirai)", "value": "4b000c83f0cde5aa3551c3bd7c604323", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773004025, "uuid": "e2872d6f-46fa-42fd-8283-2753681eaf2f", "comment": "Malware payload (Mirai)", "value": "8eda0a6477f96786e897c669f6e345e76491c8fddf52d6c24dac7ac2f29cef31", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773004025, "uuid": "6c24f795-a04c-4668-b968-8602b57f4fd6", "comment": "Malware payload (Mirai)", "value": "ad3e351df8f45524f9a3d34f029c69a2d90fece5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773004025, "uuid": "dd694894-f955-40e5-ad74-39cc75c8e692", "comment": "Malware payload (Mirai)", "value": "699c81647cdcee8318318acabc8490b8e851c574714dff929a5d0fac60cf01d575a13e787b866ea20d87e1735539a326", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773004025, "uuid": "ca0a2fcc-fc1c-474a-9de7-4b844f779423", "value": "T10013023205E5F43DE271713E8EB45A0AA3562A55CAEB363FD162426B53CD003ADE39CD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773004025, "uuid": "79f16145-2444-4f93-a9b7-d99bc0560175", "value": "768:7WxVDfLABoGgFnwVLrWieCYNjp1+530kAAGBAb17JIQPgZAI00I6ng4r1s3UozBd:7CDfMBDGIrWieXN+5ksGqJIapMngI4zD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773004025, "uuid": "394295ae-21dc-4f3b-a6d3-732dabb6a4ec", "value": 43136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773004025, "uuid": "00111eac-0623-4368-8c1f-43abff7897a6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773004025, "uuid": "bc941c4b-a890-429b-a88f-f1e35c607528", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec0aa873-1b29-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773000229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773000229, "uuid": "7206de6e-4f31-4d30-aab3-68e59fc1a215", "comment": "Malware payload (Mirai)", "value": "fdc09ece6db5acbf43fd30f27ca4f44f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773000229, "uuid": "38abe3a8-b711-4eb1-8e1b-631c326093da", "comment": "Malware payload (Mirai)", "value": "8eebd1fe78fb3e160840a5d03ac21b821f8ef01106117ff59387425fb286de36", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773000229, "uuid": "c357efb2-46fc-4878-b623-9f9ff3285482", "comment": "Malware payload (Mirai)", "value": "b42f8ab5249db26236961354dc80e2b419622fbe", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773000229, "uuid": "c3bd9099-3465-49fa-9483-5ac04496ed82", "comment": "Malware payload (Mirai)", "value": "dc6accff806645d685c7ea5355a5f729e92f27124d44d1a85037990cea01c2405978aaacf761b3da8c25a3f11fe57bc0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773000229, "uuid": "abb3300d-189b-4f2a-aded-152fc6c74c5c", "value": "T1CAF319C7FD01CEBBF40BE37644A30805B530BBA619625A3762677DEBAD2A0D81427F45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773000229, "uuid": "cfa76c4d-368d-40b2-936a-fb6319bb7b04", "value": "3072:WCeeJOrH3iiv7e7/VWntvAyEHwu/C/gJwzTQxV9jbiiLsRVyXZ3/jGuF:WQOr5Z0wuq/pzTGLKyXZvjGuF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773000229, "uuid": "3d1ac48b-b03d-40ed-ab92-42d97fee784b", "value": 163188, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773000229, "uuid": "fcd8e3bd-c4aa-4e9c-ba5d-c22a96a36e92", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773000229, "uuid": "00da5861-9bf5-48e4-aef2-16286917913d", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4bff5903-1b11-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772989652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772989652, "uuid": "5248b8f7-7e75-45f6-b796-4412a9659971", "comment": "Malware payload (Mirai)", "value": "9d36e634c314c4ade72c285dfeb21707", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772989652, "uuid": "5dd1eaf8-ea94-4a47-b9c8-5e6193a66d1a", "comment": "Malware payload (Mirai)", "value": "8f8e70a0c1fc856289a5fdd7a474e117c1e0a7b905d58c77d22772947ec00e98", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772989652, "uuid": "3fe77339-a061-48b4-ab57-ecba9287b511", "comment": "Malware payload (Mirai)", "value": "eec5ae30f0f57ed65e7ea014b96c27091d2561e8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772989652, "uuid": "c1aec750-65fc-4f6f-a968-1dc98b75ff45", "comment": "Malware payload (Mirai)", "value": "afe7d23f37e27ddcd49153eb5a5dc34d12dc7a49acd1a5667c4981e716b9d9c8315cb2a8694e0d2bad9999d059ed56d5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772989652, "uuid": "271192db-507e-454d-8793-903932b68850", "value": "T1B745336FD46E80DDF06F221B0469123D9DA825BF729833376EC69962CC96014F9DDF88", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772989652, "uuid": "07b96431-237f-400d-a17d-4dac0bf75aed", "value": "24576:Tk5vEMyrc1uZIEuvoF3JKu4Ooa6XEz+pZatj5IgHnrk8xAbpgZ4O8at:TxMM71ugT4NEz+pZ4rHrfagZNJt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772989652, "uuid": "feba289f-b87d-4cfb-a0ab-c920485d24a4", "value": 1205536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772989652, "uuid": "25b8095a-24e2-4980-8883-98ecdd22d935", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772989652, "uuid": "598b6537-0044-435a-918e-8180565dee0d", "value": "armv5l-linux-musleabi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2d16ac7-1a9e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772940406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772940406, "uuid": "945feae3-f4ec-438b-8d4e-7b6f4292704f", "comment": "Malware payload (Mirai)", "value": "a5d549ffaaa8f8cd4ffad53b805ee58f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772940406, "uuid": "5c4c6dcd-7a20-4717-9e3c-15407616503d", "comment": "Malware payload (Mirai)", "value": "919e8fb3bc3efa6fc014c99ad056ef43eb01a1d1d00a7bcdcd2ee58e099c4a8a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772940406, "uuid": "9f1431f5-fdd6-40f2-b2bf-489e0220360a", "comment": "Malware payload (Mirai)", "value": "eb57de0cbd7579e0b0f0902a30de3c97d14d1f7a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772940406, "uuid": "12d0f157-5dfd-4f12-8bda-79b100266ddb", "comment": "Malware payload (Mirai)", "value": "4ce633290975c79c91e1e7e0f0d59aa819cc3f55c602f3adf630c33684c3b0706c4081f90711cb151fea8adfccc76ff5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772940406, "uuid": "69f36d77-3403-4e0f-8055-986e9028f4f5", "value": "T134A39E32C8397DC4C1A46534FCF1EAB50BA2654444A25EFB5AD5C87900C7DA8FA0EBF6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772940406, "uuid": "8cee81c4-c005-40af-9177-e332dd31ed6b", "value": "1536:iaZwsA5XjVZJK0twtfXd/GW25UhMMJNu5xWKQk0kaXN7Y+UKigHcYSQwKprlzwf:if5Z5Z98XdmVMJa5aX7biySQHrMf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772940406, "uuid": "00d2afd3-1d4a-4752-8899-f77438c52430", "value": 107183, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772940406, "uuid": "dfb763f8-5872-47f6-b4d0-b93e80d4bf3a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772940406, "uuid": "77a26acd-2979-4531-b843-cc46fbddacda", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6dcfc06f-1b17-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772992286, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772992286, "uuid": "7637e76a-5a1c-482b-b358-3be4662034cc", "comment": "Malware payload", "value": "c433148d2ba3f7ddfe41b4e6868d2e16", "object_relation": "md5", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "tabbysbakescodes-ws", "colour": "#BCEB0A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772992286, "uuid": "172a2cb6-8a16-465a-ba22-d03c6f522f79", "comment": "Malware payload", "value": "9231e59452c8297ff346a2a6280fde4937c6fd33d333c3151414169f8bfe0177", "object_relation": "sha256", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "tabbysbakescodes-ws", "colour": "#BCEB0A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772992286, "uuid": "782c013a-061c-4f1e-86fa-65b52b6a4317", "comment": "Malware payload", "value": "5be1390b30f777c2ef5afcf7cdd29b53b4ff1b76", "object_relation": "sha1", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "tabbysbakescodes-ws", "colour": "#BCEB0A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772992286, "uuid": "5a2e2136-c8b3-4998-a3ff-a57a1e9d7f5a", "comment": "Malware payload", "value": "6475a33c9cb670cd3777b72a3eb28a993714d41888a9670c8137def3788e0c7197167dfc350aeafdeb7fdbb33aea1c9b", "object_relation": "sha3-384", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "tabbysbakescodes-ws", "colour": "#BCEB0A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772992286, "uuid": "760100ba-aaf2-4211-a9ce-26fb836db29b", "value": "T1B2E63302B5C02AC2D3899E3E73755A34249E4D0C6BFFCB787454F7D3AAF905289856CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772992286, "uuid": "4bc7a8ef-6808-4ace-8348-fb11ad2dfa11", "value": "393216:RG1RUV0nN+qZCL6KZ3r5SxNdCi+vQcxipz05p1:qK0N+uMD0xNFShRT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772992286, "uuid": "52042570-8d3e-4619-813f-a2337369d59e", "value": 15085568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772992286, "uuid": "b542cefd-1b2a-46e5-a5a6-065a604c13d4", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772992286, "uuid": "d4ffff56-c40a-4088-b0fc-85f7ff470ee0", "value": "Installer.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "346e7bb6-1abe-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1772953965, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953965, "uuid": "89dd6d9f-b162-4396-81c2-98caabf87b3f", "comment": "Malware payload (RemcosRAT)", "value": "b492b4146c4a3a1c599a1479371bd42a", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953965, "uuid": "0b10e812-b5eb-47a8-8a95-aaa7971fa7c6", "comment": "Malware payload (RemcosRAT)", "value": "9340a7e752426fe1ccbcf91f57947be86f0e9f213211ad7d4fa43ff935e19d00", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953965, "uuid": "a3d42b3c-97f2-4804-85b2-2ad96bc26c96", "comment": "Malware payload (RemcosRAT)", "value": "f8f3c21f8bd5935da5faa0f08d45eeac7d7a622c", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953965, "uuid": "3b8d20cf-52b1-4722-91e8-9b332856ec9e", "comment": "Malware payload (RemcosRAT)", "value": "e933e84d281ef3e28096938b1eaf6a50c4179d70759be2d46738b663197ccaaaa932046fe9311c1320ac0465a4f98493", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772953965, "uuid": "2749c15b-9f8a-422e-ae61-5be56e6c533e", "value": "T15CF59E53DE886388D65D3B0A94EE6212FF7045EF290D451FF6B67A8CF95F14C200AA8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772953965, "uuid": "1275331d-6a70-44bf-aa0e-fbd3e385a67b", "value": "49152:QmbqZ2dJajWg8nPlzE2NAepxMovPLBNgj0:/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772953965, "uuid": "98dc3cac-a7b3-4095-8c49-17383eb997ea", "value": 3323384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772953965, "uuid": "761cb4a5-38e6-4dc2-91ae-295c216bbd71", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772953965, "uuid": "7335e03b-43fe-464f-9d37-f4deca19cf96", "value": "b492b4146c4a3a1c599a1479371bd42a.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e723c6ba-1abd-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1772953835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953835, "uuid": "913bda16-14bc-4749-a19f-75ce84f36f1d", "comment": "Malware payload (AgentTesla)", "value": "46a2b0d1987319e7a9736641f7cd480a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953835, "uuid": "e4f0be47-486a-4794-bee4-8f7733fa1dfc", "comment": "Malware payload (AgentTesla)", "value": "960e3c08b29dfcb9ac068b1e848f607cb5995c524faa07a965cc7b353b0d08f1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953835, "uuid": "36a88e31-f1b3-4bed-834c-78ce33059f6d", "comment": "Malware payload (AgentTesla)", "value": "df563210077c1d476457fefa1d2faf00c9844281", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953835, "uuid": "1934f547-3e28-40e2-b56a-6780b5418a9d", "comment": "Malware payload (AgentTesla)", "value": "f019f06b9d555d0720691e4ce8f2ee5b960d6ff3c5597135e63f8803eaf2a68bfa39ae02fca887a96a869097dac0f1f3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772953835, "uuid": "65b0ba1b-1843-4b06-8f36-8d7b0904cb52", "value": "T1C745B51E910B1777FB0D05DF9826F3268D99C010A053C4BCB6686ECA2FA457DD1B63AE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772953835, "uuid": "fc70be81-b41f-4afe-8ca6-2644a365b6a9", "value": "768:BDDqUgMx3R2DMRBt8f25MahKBK24MGBMxnV2oM4EHUiY21MVBBcxuh9wHTFbcf8M:1m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772953835, "uuid": "9aaccdf8-f848-477f-ba5a-691e9fdefca4", "value": 1183394, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772953835, "uuid": "abb87c08-c680-4dc7-9074-2d5764cfd1cd", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772953835, "uuid": "2ba3d432-a88e-4262-a57a-987370fbd15a", "value": "46a2b0d1987319e7a9736641f7cd480a.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a651232-1abc-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1772953116, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953116, "uuid": "06da5823-0f95-4012-87f2-f9e3659a2ea6", "comment": "Malware payload (AsyncRAT)", "value": "349ac81792bd0ca81919e18b4786e6b8", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953116, "uuid": "7e67ac2a-d8d1-41e7-a858-f4ccf5dce469", "comment": "Malware payload (AsyncRAT)", "value": "9635a1485df837e42d64f82095536ed45364d6af1d820b8107855e3be352e1b4", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953116, "uuid": "e659e496-88f2-4d12-ad5b-bfd55aede6e1", "comment": "Malware payload (AsyncRAT)", "value": "68b6e1bc8418cf7c4311995b0cacc40c4edc521d", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953116, "uuid": "e454115b-1467-4ba0-923f-ef45901622b8", "comment": "Malware payload (AsyncRAT)", "value": "ccacba444e8e91dcedf9284c804bba878463bcc3d1c096d1889f467471a641265fe9992f0d5c705d43dd5d1b626f5c3a", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772953116, "uuid": "797e0529-42b9-403a-b7cf-99e3c74e4667", "value": "T117E507216E0A86C042474C78EC57F138FC051C66E557090E315AEBCBD9299EA8EBF7F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772953116, "uuid": "5bb8964d-20bb-4352-bcd1-eb0e331fee27", "value": "96:ixxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx8:3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772953116, "uuid": "c4e1d786-7830-4a6e-89fc-564fe72b095c", "value": 3278884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772953116, "uuid": "831df85d-cd59-4114-8612-c35d8d10e322", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772953116, "uuid": "55751ada-4b3d-43d3-9d75-f6a23fa4ecf5", "value": "WMIEventLogs.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e839921-1b01-11f1-a769-42010a9c0008", "comment": "Malware payload (ScarfaceStealer)", "timestamp": 1772982704, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772982704, "uuid": "88411b12-3c4f-4ece-9d42-5b9cbf341339", "comment": "Malware payload (ScarfaceStealer)", "value": "dca248f6d82c1b7b56c06474b96f2afe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772982704, "uuid": "8fc90a84-772b-4ffb-ac15-7a3a9e9060f6", "comment": "Malware payload (ScarfaceStealer)", "value": "984fd0f96cb6b7c24e9362a46b38aab89f8f3b21741d13012f82eb2c420a4a3f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772982704, "uuid": "37a98691-04ad-46f8-a57c-c2433457e915", "comment": "Malware payload (ScarfaceStealer)", "value": "e39f4de00dbab7527b05e703496e8f3cd0f0a00a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772982704, "uuid": "a5f99de5-1d65-46a4-a22b-abf8dc19decd", "comment": "Malware payload (ScarfaceStealer)", "value": "3ec34c8018c8541dcea8303aebbebdcb58caa2a90a5f673d4ece9395f68fc7414ad38468c1911bc594ce5bca53fda1fd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772982704, "uuid": "492013de-c072-473a-85ff-4fea56e6f545", "value": "T14FD623E984D523E4C8E34680B58653D971C0266E82ED4C2C7ADB6D012F11DBF664FEBB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772982704, "uuid": "d12bf250-41f3-44f9-af3c-84b8fda1ec1c", "value": "97e9a22ab1d360526f268974f1500e72", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772982704, "uuid": "2c157da1-2510-4167-848d-4ec6a88c28ce", "value": "196608:d8lLHi+oyU5z98dk39Sfg99+2V9YUbKopUaxBswzTvOTYb4iK6hDOMz3z28X:Oi+d+9863Tw2VRPRnvIY0iK6JX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772982704, "uuid": "b60fdc16-428f-4c29-b872-798ae89f1ae9", "value": 13347840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772982704, "uuid": "9f583278-181c-4c90-b9af-91aac06db763", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772982704, "uuid": "c57d0fe8-fd17-4c28-a3a6-dcc2319431ba", "value": "farion.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "094a9452-1b00-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772982239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772982239, "uuid": "366f3c99-2775-4429-96f3-e7d94334dc05", "comment": "Malware payload (Mirai)", "value": "506280ec31c0ec052a5551e6c14ce3b5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772982239, "uuid": "b9a2f1a2-5f8e-4b66-9af7-8e51e758cf2b", "comment": "Malware payload (Mirai)", "value": "99bb50fd4b8cc8fedc8301adffb242bab2cb25608da68d2a2a7fd78a7eff7217", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772982239, "uuid": "5652b346-97c5-4551-a602-b4abed1e758a", "comment": "Malware payload (Mirai)", "value": "94a5a59e9bc85cac034e82e8c93bffea9d16586d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772982239, "uuid": "4aee7058-a1df-4ee0-83b3-945cf79cfd60", "comment": "Malware payload (Mirai)", "value": "f6b29c73bf4dedba31f3b379075e0bae96bdc050ef025463ff32c22357dba1af32e71f4129f8d4f075185fce167d4008", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772982239, "uuid": "6d4fa27d-7725-444d-8f01-3848dd40da4f", "value": "T1D675337684BFC753F5EAEFFCAB3456E201FA3C0BA59984E0EC0D46114E21E960614B6D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772982239, "uuid": "f08b0eb2-4a81-46a4-a5c5-d4a6b3683984", "value": "49152:BLakNs4pnsgGTRxkm4PBT1ygYAax8eX5Z:Fbbh4xF4BMrv/Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772982239, "uuid": "a9697533-5f08-4440-8df9-28fde90d310c", "value": 1688488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772982239, "uuid": "030d34ab-9c0f-4d50-806f-e84d51e01dee", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772982239, "uuid": "082c5017-fcb3-4983-ac9d-fdf759af0ba8", "value": "x86_64-linux-musl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00a1f85d-1abe-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772953878, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953878, "uuid": "25bd3fcb-a545-44bb-b499-9039fc998c8c", "comment": "Malware payload", "value": "2fecc4793749c6e18f1df18920484ada", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953878, "uuid": "94fd0ae0-ed9c-48d3-967e-2f3c04e3c271", "comment": "Malware payload", "value": "9a7bbc9f43c69bc6845e3c349c3c93630b51566a2eeaae74df37f34c36018d97", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953878, "uuid": "a54aa1d7-c7d1-4d6e-a08b-78bb13a148ee", "comment": "Malware payload", "value": "5f3466c5e79300d2739b1d42d5b62266e0cc0ab2", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953878, "uuid": "bb496df3-ae98-4844-bafb-0b4a3fd1e2f3", "comment": "Malware payload", "value": "095a46c4a90154734e12db3e32fe15ec9476c52fa577ec112526769fbd22e9e153668f3208480fe7c51419b7138f8d6d", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772953878, "uuid": "e3acabd2-c3b3-430a-a027-97fb7dea90f8", "value": "T1D6D2329C2EEFA268134E30332C6BB496F26DDC8CB55DC864E3E25CD9F85C3089579958", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772953878, "uuid": "6a290e70-20d5-49d5-9ba1-b0a380b97c92", "value": "768:k5AtHMiL2YxQ4avzPdHk0PjOajZmw3A/lFni00J5BWmJ:bHMiL2h469790/lFni0yBP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772953878, "uuid": "a04e9175-4e2c-4242-833c-0aeef8719130", "value": 30951, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772953878, "uuid": "3d5a854c-b5ce-4999-86a3-23fc90d069e5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772953878, "uuid": "36ec1be2-7a83-4597-a6b8-18fd635243ef", "value": "2fecc4793749c6e18f1df18920484ada.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36784941-1ae8-11f1-a769-42010a9c0008", "comment": "Malware payload (CoinMiner)", "timestamp": 1772972007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772972007, "uuid": "786d548a-cbe5-4c9c-a50a-2ea39bbea9dd", "comment": "Malware payload (CoinMiner)", "value": "3b18a8cf35883664f7a0ebda6080677e", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772972007, "uuid": "9912dd04-3189-4c2e-852f-596ea67d056c", "comment": "Malware payload (CoinMiner)", "value": "9c337452ed46748b08e42569a8a3a3146137a467991838f52c6e8a26274837c4", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772972007, "uuid": "c03771e7-8264-47d3-a9e6-2d16946c4cbd", "comment": "Malware payload (CoinMiner)", "value": "fcce0b7fd2ac720bd39e5c4d0709c007ccdf9e86", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772972007, "uuid": "29fd571d-4289-4f2c-9c1a-81f047630524", "comment": "Malware payload (CoinMiner)", "value": "f90a565c417c0932d6d2fa69a22373d0a90f9366096964fac58a2b00c6c9fa4aa1ac023123351e9ed9c76f143b005fcc", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772972007, "uuid": "e911ccf8-fa9d-4961-acd0-d5a539250537", "value": "T1F8B633167D8431ECE25BD43E278519919773F4C51F3ABAC762C002F4AE58AAB1F78326", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772972007, "uuid": "12de78ae-541b-4738-82d3-429282da4e2c", "value": "95cbd5fcae6c6b7e32644aed3412cbad", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772972007, "uuid": "830c9e0a-4b5e-4e4b-be14-d5370add219e", "value": "196608:EcFzItzWe6COQKWqbpTLKl+HQ9UU2ma4Q+AVR7FjXyvpsaFPlAeXE12:VFCtKVTWlWQmQaLR7YxPueXE12", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772972007, "uuid": "8304acd3-5615-4d7f-9ca1-e61ff80e63e1", "value": 10875136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772972007, "uuid": "93c904e7-1493-41d6-8221-033b243cda7c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772972007, "uuid": "753c6832-19de-47fa-99be-2f39ddf3eaba", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edb4b1b2-1a98-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772937955, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772937955, "uuid": "f789631e-7c34-404f-91a1-2de184a8c834", "comment": "Malware payload", "value": "8b12f2772897f2314ad8bb150ab47635", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772937955, "uuid": "acf7e5ec-8ee3-4ebc-a7b1-a541cf691ce3", "comment": "Malware payload", "value": "9f094dfe2cd494ccaedbe44470578e67bcd74b6279f6abb7b393b6afdbeaae36", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772937955, "uuid": "09b13def-2a76-4a72-a284-7764cb787410", "comment": "Malware payload", "value": "81bc080c137804d145fbcd94a32353055bc6af17", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772937955, "uuid": "91d4fa3b-b7d9-4495-a495-951d6fa2ee48", "comment": "Malware payload", "value": "b6724e77ba78ee99b78a26358dfd5bba3698a75b6b1f7eeb4c6d3de91d478de9a946c4fdc697734a02ba792911368dfe", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772937955, "uuid": "80023e34-7df1-4347-8041-f3a00c141e95", "value": "T111925BA916496C79BBC0DE7D9F3C7F0CADE481C02218A3ACBA4F39705A2069DDA0535D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772937955, "uuid": "3c8120b3-a3ef-435b-92e4-bf8bae2b92a2", "value": "384:uB0M3vgRjGlsaq7YzsO9a4cbddrME8jyfzsO9a4cbddrME8jy4:uRmjfMzsP4cbddr7zsP4cbddrk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772937955, "uuid": "ed594e9d-3d21-4039-9cb2-8c3671437720", "value": 19499, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772937955, "uuid": "e8950b75-99a0-44f7-88a9-d36328d4ab9a", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772937955, "uuid": "d92d26a9-4171-4e11-b92d-d3c0a5313a45", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7389c7bf-1abd-11f1-a769-42010a9c0008", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1772953641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953641, "uuid": "c2d87d8e-5d23-448c-9bc1-e2f4a6f79e5e", "comment": "Malware payload (SnakeKeylogger)", "value": "be8c95c50d3e0c635975d21de3b8d5b6", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953641, "uuid": "aee57717-ce94-4627-b96a-461248e1425d", "comment": "Malware payload (SnakeKeylogger)", "value": "9f6057d2185a9b1f0dc11a37dbd6710da82af0a2625a4455da0941ea44e14d13", "object_relation": "sha256", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953641, "uuid": "4b8ae5f5-77ea-4e7c-a5be-466719f06062", "comment": "Malware payload (SnakeKeylogger)", "value": "57d676bc50cda0a74a09846be77108f433e5236a", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953641, "uuid": "189ce81e-d894-4fdb-951d-1038100091e3", "comment": "Malware payload (SnakeKeylogger)", "value": "7e552a6aac3983f73f503e55b2ac3285d0978ca90ccef21d3573aac05b0ff5f1805ee912498fe508c4370ee196405171", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772953641, "uuid": "b2e2c15a-e2a7-4e68-a338-53c026e9c7a6", "value": "T19E551E6077E61985FEC1F608DDCBA30BEE547DBF6D441C20883F85A91608AA31E7E476", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772953641, "uuid": "735806f6-49d8-4f9a-afdf-1dbb533eb565", "value": "96:9hhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhR:LQ+oHUWNTTEU1w0Y/eO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772953641, "uuid": "003b184c-ecaa-4995-86cb-7912c8017552", "value": 1284721, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772953641, "uuid": "5220145d-62e5-44e3-8a8f-8535d6146409", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772953641, "uuid": "84c40b49-1a72-4293-a71c-bd61d56867af", "value": "be8c95c50d3e0c635975d21de3b8d5b6.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69ef8a27-1abe-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1772954054, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772954054, "uuid": "94eaf3d9-8cf1-4028-bc7a-cc5a003d2906", "comment": "Malware payload (AgentTesla)", "value": "cc6f138587b4dbcb63a3e86291bd51c8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772954054, "uuid": "b63e8afa-dcaf-47ea-bb74-289cf77f5443", "comment": "Malware payload (AgentTesla)", "value": "a0229d00383807201426e9f5b5438a412c6be05463125ef862faa6fb76193403", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772954054, "uuid": "e3f85d2d-9df7-42d9-bacc-845a3d1dd818", "comment": "Malware payload (AgentTesla)", "value": "5fbcd1f195899f11c470b2ed061a06c117522edd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772954054, "uuid": "8b81871e-2871-48fa-9002-c9d8421517c9", "comment": "Malware payload (AgentTesla)", "value": "73c9a3eddc0b242a21566235b924b0bbafa3f50a54e332e6e4abfbec26d7c8a46d44c8afbf72123418fc55f40a2b051b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772954054, "uuid": "c7a4f3bd-6a39-447e-ad5f-84d3262778d8", "value": "T170E256627DCF4EE416A39B67F8956C6E800CBB167053BC4F3505E29AC6137EF046A6E0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772954054, "uuid": "e3aa6e5a-626b-4340-96b3-ed84960419b5", "value": "768:yE/iPME2HAaWPiZdwb/Z82CP1Xk0okg69A35FJI1LYHAhg0Uk9Q4Yifk7pfI2xCO:di4AaQYdw98NakxE5RAhgr43YTYnljxm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772954054, "uuid": "cc09e1e1-2613-4028-84f0-096f1a2c3439", "value": 33977, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772954054, "uuid": "f565027e-3aea-4733-bf3d-51c80f361a3f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772954054, "uuid": "6ecd9f31-80de-40c2-954a-64eb761a7f7c", "value": "cc6f138587b4dbcb63a3e86291bd51c8.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56c57a23-1b29-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772999978, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772999978, "uuid": "7f3bbe70-5d02-4375-bb52-1bd12ac8011a", "comment": "Malware payload", "value": "6fb09b6b8bfddd5491b5307f6ef5358e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772999978, "uuid": "5e9b539d-d9e1-4169-8e99-dd9836ba19e4", "comment": "Malware payload", "value": "a1340e6fba9e78738e2504b34bbc01c10f00242fb1585dae152af932b52aebb9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772999978, "uuid": "dededb7e-1dd9-4e03-b2ac-b11b5fd00097", "comment": "Malware payload", "value": "7d591e4ff953fea72a96553c5090b6dcbcfdeda2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772999978, "uuid": "1e86c51d-44bb-4242-9712-cac078a7bf81", "comment": "Malware payload", "value": "d8461b716b5ab03f895a5e93e73cb6104dcd3dde4bc5c1349a0e25be05690063fd66ed4e4caac125ce7a098885af045f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772999978, "uuid": "9a3f7d98-f0ce-4736-ad2a-d21b6e1ea728", "value": "T1286723D268DA72D087D30544638E12DF21C258BA86ED99157AC66C039B30EFF294DFB7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772999978, "uuid": "1f7997e2-c298-4182-a330-53a04db2d5c5", "value": "935f401fbefe56e6277c13307758a82c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772999978, "uuid": "8125bcdd-58de-45bd-8e7b-9ea8c0ae726d", "value": "393216:5HM+UF7Ehg13fhFihdTPzeg3sUDQFvQKF62WF+oVgs9e4I2CCV:1MLMgpfDihpzegq+lnMoVgoBII", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772999978, "uuid": "72281f72-c3ed-4117-adcd-25afdee42c1c", "value": 31774208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772999978, "uuid": "39127271-37f8-4596-ab3c-4a22015dc6e3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772999978, "uuid": "4605fafe-72ea-4be6-8ae5-3008a651ba97", "value": "erto3e4rortoergn.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83ae3efe-1b29-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773000054, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773000054, "uuid": "8aa89884-bb60-4788-a3df-51413cc4226e", "comment": "Malware payload (Mirai)", "value": "358c537f15fe406875292e9453c4c64c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773000054, "uuid": "c9a15cee-b7f8-41bf-aedd-ef0db6ac4fd4", "comment": "Malware payload (Mirai)", "value": "a18891f23add11fc828efbedcaa438fb4a8d77f08a051b101b63cbd18f156f90", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773000054, "uuid": "d7524acf-a0fd-48fb-bd91-98d1335c67b2", "comment": "Malware payload (Mirai)", "value": "2eae1c46f91316a2996009d786e615638bd34659", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773000054, "uuid": "61bf0f24-6d66-43a1-8ceb-930e7795cfbf", "comment": "Malware payload (Mirai)", "value": "0dc84583f5912217e584de3e4b3c8fa79c40735e5045ca41241bba25288565f8a40bea3b350fb1c9b182d713d0184701", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773000054, "uuid": "c6ba1c8c-839e-455b-86a7-cff3731f9d1b", "value": "T1E113E0256AF80E40F06111BD4A9A2C8D0694E3ECC4CD9D8789E07536BCE27399B6C7D7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773000054, "uuid": "cdd773de-9a6d-4af2-b0da-111a5e117aff", "value": "768:r7lMBJB34XAKVvp+GMhFkRNtB74cLj8lMwj6kJjPivXVD1b+ODjnbcuyD7UHQRjX:ro73X8vp+GsFk/75+J7oXVPDjnouy8HU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773000054, "uuid": "0c2302a1-9825-4755-816d-331efdf5251a", "value": 41764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773000054, "uuid": "eba295f6-1e7b-4567-b6cb-c75c97af1341", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773000054, "uuid": "2cbb8b22-9bf5-4d02-a7f5-213f8a7d38b5", "value": "x86_32", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b818043-1b2f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773002671, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773002671, "uuid": "8892dfc8-d453-442d-ae96-eeae6e44d4eb", "comment": "Malware payload", "value": "e0b02df1ad032e459468ff1ee97bba23", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773002671, "uuid": "2c710b06-29b8-4f3d-9619-5ddadcae6ffe", "comment": "Malware payload", "value": "a198aedff4f84588326b22aa1ff900f287a3e904f16f172a308c8affe9342f25", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773002671, "uuid": "94408c65-0835-4902-a374-6ed0973a1047", "comment": "Malware payload", "value": "2abea88889b826f266e582f2ac0d04a91e281c7e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773002671, "uuid": "be4079b8-c903-4036-9065-a203faa06ed3", "comment": "Malware payload", "value": "89d1cd0b7f0c3dc86a632f14cf6b0f56af4092190323024050fa0fabfae31296def8c28d490d28eb6b89d58e7c8b4dae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773002671, "uuid": "9544950b-afc9-43a3-a6f1-ef47e6e3c6db", "value": "T10BE5337AFB03A9EBC1D44DF1586952F222519C1351500B7BF9BC762E0FA135ABA32437", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773002671, "uuid": "7d09bab5-3136-40bb-b3a6-32a93bbac0d5", "value": "b29f7bc6c3cf27ba78272829148a5262", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773002671, "uuid": "5dc79b02-8a16-4c37-804b-a917f2c620f0", "value": "49152:ao8xwkY/P5oHYN7/Lqn8pEOFVf2wAygvzf068iLvi5fTPy09/JggFDHnEa8rcvlU:j8xwkYH575jXEf0HXLlJZFDH38I97Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773002671, "uuid": "26261ee0-37d1-47d9-92f3-393e8568b249", "value": 3304133, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773002671, "uuid": "240d6f2e-a36c-4303-b849-2a2ff37a19a7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773002671, "uuid": "b8e478c7-765e-48ed-83cb-67555a765134", "value": "fps.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71a3ad55-1b27-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772999164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772999164, "uuid": "66c30376-4ace-49fa-85dc-34bdb32b4611", "comment": "Malware payload", "value": "caab3b6a3fd6c8c51e6345a7dd3940fe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772999164, "uuid": "ed6e4c8f-e70f-47dc-9b41-685b6d23d9f5", "comment": "Malware payload", "value": "a1ae5d3c3c46595508f9ae116394cebccef49fddc7211003f20cff9bdae21bf2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772999164, "uuid": "66054ec8-bdf3-4a79-93ad-517df59ee202", "comment": "Malware payload", "value": "239a875fe9d261bd0e09b7876cec685a41f699c7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772999164, "uuid": "a3621ece-48a7-43c9-96c5-d586b0fe8aa8", "comment": "Malware payload", "value": "9149b5d248ddd141e1b811e2a844d436d0fafeac6af8ffa539bd325a251a10b64b393f4eaa4659c888fd91ec326c949c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772999164, "uuid": "d824007d-a552-40e7-9024-7830d4e35a63", "value": "T19FC622F946E552F091D24600618B93AD70C1A99D82FD2C2D3EC72C822758DAF664EFF7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772999164, "uuid": "12c9a7b7-63d3-470c-8178-48cc13bf1120", "value": "49f672576a1d2e85277440214dff6b1a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772999164, "uuid": "cb8357dd-4a6e-403e-8883-0836b349ef08", "value": "196608:6h5W8MpsBaykYZ8COSAQrS1ZUX2VmgQCzA7v/p5gEh40z+:V8Mpo8COCGKdcEKd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772999164, "uuid": "4f1167b4-8d51-45c6-b5bf-05709d80e166", "value": 12418560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772999164, "uuid": "0d55f337-7b9c-4963-86e9-6c62d80ea28c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772999164, "uuid": "d244ec54-f35b-438a-a9e8-d61e72afc501", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6cbccdf1-1b22-11f1-a769-42010a9c0008", "comment": "Malware payload (SliverFox)", "timestamp": 1772997009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772997009, "uuid": "b0ff88f7-954a-4c0e-85ca-86c0ae39c1ef", "comment": "Malware payload (SliverFox)", "value": "5a6d5cedc838f10c690aa58523c89fbc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "SliverFox", "colour": "#76DC89", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772997009, "uuid": "71646be1-81ce-4b41-9704-7e5b5ddfecab", "comment": "Malware payload (SliverFox)", "value": "a238c729fddbc25f6523b45e6463dd54521d42e364bed3f811b84454b54d8b44", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "SliverFox", "colour": "#76DC89", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772997009, "uuid": "5f654373-805c-438d-aff3-424ee92c3e92", "comment": "Malware payload (SliverFox)", "value": "9a9a934f22d5519b2266bcde93f8963cf79635d0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "SliverFox", "colour": "#76DC89", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772997009, "uuid": "3d1b31c4-522b-4eae-8901-2a3965af43d3", "comment": "Malware payload (SliverFox)", "value": "0f9dc6ad286d66d42c76e0b99902818708a9a0030bba9d89b0ed0213f73b5319b87e62bc41b7ca2215a835cfa3bcff37", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "SliverFox", "colour": "#76DC89", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772997009, "uuid": "61b4b9a5-b22c-4faf-9e46-50483511b7b4", "value": "T139383357B58CB13FD09E533545F3AA0028F3F229AA275D9697A0D4CCCF6A1C02F7A664", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772997009, "uuid": "38b52546-0e9e-4cfa-bb9a-2e3f0499386d", "value": "eb5bc6ff6263b364dfbfb78bdb48ed59", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772997009, "uuid": "f8c656cf-ffd1-4f09-a20d-88600f6afa48", "value": "1572864:q1+I6TU9DM6/3x7Rh2JzHtjw+TyK7csZqP9jH2J6rPUUeDxXC/uSggEHhW:q24p/t2htjzTyJ2wIJ5fDA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772997009, "uuid": "c923343a-2b9a-44ca-aee8-49583bc5d56f", "value": 104276341, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772997009, "uuid": "bd4afebf-4d14-441d-a1de-bccfe879dba1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772997009, "uuid": "3fa28db3-1aec-4b7b-bb30-a488c9e72a5c", "value": "win32-Chronmestron.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c8b35f6-1abe-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772954005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772954005, "uuid": "70bbce8f-e8b1-4349-9b28-1f759003c326", "comment": "Malware payload", "value": "f24da39a2ea0d84b2ee3cf954e888803", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772954005, "uuid": "e9280de6-bd4a-4f17-85f7-e58a375b1b14", "comment": "Malware payload", "value": "a3f8451de11d00bede6ec55852eb111870501372d62bbb283ec96a9655596ea3", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772954005, "uuid": "6c99a35b-45e5-4ea1-87b5-daf3d4cb3616", "comment": "Malware payload", "value": "b35e36ab4efa4fa36ae6b8aa729761976266baad", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772954005, "uuid": "85fd1231-8ed1-46b5-936b-3f7a38064797", "comment": "Malware payload", "value": "39d05994b14112ea0dcf4b9580d756974540441c9c0f6c64eab2a91b26944cd4dfb252ecdf20e451e431f026d5987441", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772954005, "uuid": "47ac3805-b623-4802-a54c-b3d8f007b355", "value": "T11A7359B0DD2215BB4F43BB49FCE54661CA78C314952604B0F5CD870D920EAECEBB966B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772954005, "uuid": "62c5be92-757d-44a9-8ce4-c90826407a5a", "value": "1536:1hjgp8XtkklTUwaOk9hHnmWF2hcpRUBgIlBS44xrpjGEX6k:1hjgpXWUwaOkXnmO2hERzIh4xrpjGEX1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772954005, "uuid": "30478dff-6540-4348-87f9-843d6a1cbccf", "value": 79482, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772954005, "uuid": "0a738d9b-b542-47ce-b42a-bf6a8dae891a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772954005, "uuid": "8082212b-eed7-4bfc-ab14-2f5ca07b51d4", "value": "f24da39a2ea0d84b2ee3cf954e888803.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1dbb105e-1b35-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773005037, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773005037, "uuid": "d36ae6eb-4ee5-497b-8987-eeeb9609a9cf", "comment": "Malware payload (Mirai)", "value": "86cf5ef3098e4206500124188677698f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773005037, "uuid": "6a3d6145-13ce-4e2a-8826-b67a4b59d59e", "comment": "Malware payload (Mirai)", "value": "a44bfcfada183168dcbf5e952a26080a3a94708421b4db23aa2c90aade403aa3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773005037, "uuid": "27d8f775-fedf-4d45-9bdd-13f44a53e98c", "comment": "Malware payload (Mirai)", "value": "177fe8ce485ad23862cbe11dd7945d5829c20ce1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773005037, "uuid": "1f1c3966-d6f8-4b3c-9241-1e9e97b2d7b9", "comment": "Malware payload (Mirai)", "value": "28473e13257a2cc37598a6928a2c772b09bcada26610c5fe4ddca74a6e6ae6114e5a300197d8c9a124ae3c2daca3efa8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773005037, "uuid": "dc15ccb2-6304-4eb0-9bc1-99932851603a", "value": "T125930852BD819613C9C566B7FB5F4299371A0368D3EB3203AD249F31338A89B0F7B945", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773005037, "uuid": "430c4114-b021-4a4a-96af-810c7f4f5320", "value": "1536:iqTHR2q9o0F4KSylW+gnlX21krSC+y2ae6stFW9VsFEthm8ROjoWe7Nv:Lx2AoCN3W+gnlKkrL+y2LSVle2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773005037, "uuid": "71f1f8f8-8938-4ea6-bfdd-377a4600dea8", "value": 92020, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773005037, "uuid": "055de5f3-34c2-4267-9b01-c9952334a903", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773005037, "uuid": "37f5da92-9b29-44b1-be4e-de1ad7313a50", "value": "violetarm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5bfc7e88-1abe-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1772954031, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772954031, "uuid": "a62fa864-1951-47be-8da9-0ac042df8815", "comment": "Malware payload (PhantomStealer)", "value": "8e5c71f1d7cdc48349412a222adb3e4f", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772954031, "uuid": "78573cbb-470b-40e5-a9a0-c9102581d4eb", "comment": "Malware payload (PhantomStealer)", "value": "a4b36abcf1894822fe9b836f7d4d16f6275030e13d329494eab3aab46cf1f628", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772954031, "uuid": "9d33dcca-6946-4b4c-b70f-492b239c19e6", "comment": "Malware payload (PhantomStealer)", "value": "e311d00b67ec44a669765aef6a62a54a166ab800", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772954031, "uuid": "25bec820-3218-4a49-bb70-27dcb3ed9cf5", "comment": "Malware payload (PhantomStealer)", "value": "5aa7dc98a5853df09830e44e6f929eecfea4991e86d756087395857e1703694c7c21fb9998bb05e6339cda6492d330a1", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772954031, "uuid": "7a120fa7-0409-410d-8dc3-9e5f15e39afe", "value": "T12626AF028C840BBE981A793AB1FE719992E1D78AC4405DFDFB313D1E9D2E8C117576CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772954031, "uuid": "a71fa398-ddb5-4278-acad-91ad6c5b94cc", "value": "49152:bm6yaa2TXwJHpn+c+F6q/Et2BEw7lVGlDMGMPn65BpCiwD+1bv9db:s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772954031, "uuid": "08aa9c38-9cd0-43ba-a9e1-d4d4625c0129", "value": 4684712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772954031, "uuid": "5b4e5ec1-31ac-464b-9045-aa545c40a952", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772954031, "uuid": "edddb86b-8147-43bc-8a90-9dabae05b5b9", "value": "8e5c71f1d7cdc48349412a222adb3e4f.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79409878-1b2a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773000466, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773000466, "uuid": "996bd1cd-076d-4560-9a18-2c5b4c3b0718", "comment": "Malware payload (Mirai)", "value": "c086950295d3787eaf03afea411f6cbe", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773000466, "uuid": "d7ce624d-adf5-4645-ad23-ec12eebe667c", "comment": "Malware payload (Mirai)", "value": "a4d21fcfe726542642e7e4b17141ad84ce882f691a56e36c3279c56c286f951a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773000466, "uuid": "fc63264b-64e4-48e3-afb0-e1655aec4186", "comment": "Malware payload (Mirai)", "value": "c74e86cb7424c53022767b128e2ab716f97bbe8a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773000466, "uuid": "5e4a7075-3a6e-480f-95fa-ab200d53a335", "comment": "Malware payload (Mirai)", "value": "2000ce06ee3e43aa050691d7d9888e5e0997caba184ee2cf5fcdaec383973bd80a458ccd0baa100ea94fbad451f2d992", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773000466, "uuid": "8e0cec51-f75d-4d8c-ba69-73ff41fe13ca", "value": "T1AD0418C1AA02FEB3C5C39FF502A7D71009B2E8255B6B8E45F3AEADF04A565C8710975C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773000466, "uuid": "692e5d60-c5af-4079-abfe-b0705e904e04", "value": "3072:n0u8BfTZQmq9FBBP4d+deB6rkW6g+um9KNZY38I3DLRZa3itU:n0B8ggQB6rv6Dum9KNZY38I3DLRZa3iG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773000466, "uuid": "33a5b7f7-4894-4ae0-87ad-ea6caf9f9407", "value": 174814, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773000466, "uuid": "860323e4-1ab9-4c0c-9044-43d87ed60a24", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773000466, "uuid": "4c72cd0c-11df-488e-83f4-e2e39c3ce1f4", "value": "x-3.2-.dick", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71df1384-1b00-11f1-a769-42010a9c0008", "comment": "Malware payload (Joker)", "timestamp": 1772982414, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772982414, "uuid": "feecb790-04df-42c1-9fbc-fcc94e60d6e8", "comment": "Malware payload (Joker)", "value": "a14f5ed8b9552652d03fc0f2d0c180e0", "object_relation": "md5", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772982414, "uuid": "4e7931b3-3427-4aba-a924-5a11f7854c33", "comment": "Malware payload (Joker)", "value": "a59921bcefc601542a2ebd54002169b3decc0af2692b9e416233f4229d1f3baf", "object_relation": "sha256", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772982414, "uuid": "55096a28-2f88-469a-8220-51b85dca4a78", "comment": "Malware payload (Joker)", "value": "d1a2dd0ced1237609cab422b2d8c4d346f9253a7", "object_relation": "sha1", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772982414, "uuid": "56929dad-176b-4556-9c09-68683cd23004", "comment": "Malware payload (Joker)", "value": "6f87e9b7a1f7651b58fc4c6195a0c4af4b6060ac74adc040bfa38bb7143ddad07b53d2659f7880b3ee0c93590f207537", "object_relation": "sha3-384", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772982414, "uuid": "f29aef77-a760-45d2-9561-aecb030765c7", "value": "T193A61249EB0C943FD9FBB0BA4DBE0261525B28468103D753791DA60CAAA77C44F6EFD0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772982414, "uuid": "65653286-b6e8-4667-b0da-b660588b123d", "value": "196608:fAm6WEedxTjnxYwsEMqef5mQ5A6hlKtLBv0broXgiAy23ma9:4m627DCpEMqep5A6OLRsrOpAr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772982414, "uuid": "44162125-9617-4351-9f83-da05d96dd17f", "value": 10113372, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772982414, "uuid": "ffd0f5d9-84b5-40ae-8499-939cb382d81e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772982414, "uuid": "47e5a2c3-1223-4ef6-9d43-914cf6a74b36", "value": "com.pilots.mergence.advclean_1.0.6.xapk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa493d10-1b17-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1772992522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772992522, "uuid": "628f7015-9497-4013-858f-7e2dbcd389be", "comment": "Malware payload (ACRStealer)", "value": "8b28c7017e1350c0128b629ae9fcd81a", "object_relation": "md5", "Tag": [ { "name": "46-149-72-226", "colour": "#F2DF1B", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772992522, "uuid": "bf5a3c81-d35d-4330-84d8-033193bf8548", "comment": "Malware payload (ACRStealer)", "value": "a5a8d8365fd4e5ec13f60ae47ea34c3a1606630c2d7f4a3a3085211d0fe9e913", "object_relation": "sha256", "Tag": [ { "name": "46-149-72-226", "colour": "#F2DF1B", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772992522, "uuid": "96c99cee-b5ca-42ed-a00c-cb16504c8f1d", "comment": "Malware payload (ACRStealer)", "value": "496b90159301312812d9a976d2d521a0401d8ffd", "object_relation": "sha1", "Tag": [ { "name": "46-149-72-226", "colour": "#F2DF1B", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772992522, "uuid": "bdd7a998-8c6f-4534-840e-98d2f1e8dbf8", "comment": "Malware payload (ACRStealer)", "value": "127ce8698158a81f13639a5d8a6d86a89c5a753d30db36fc324e54924b8f2f949d49ada56d2c849a38b9fbe482f6aca4", "object_relation": "sha3-384", "Tag": [ { "name": "46-149-72-226", "colour": "#F2DF1B", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772992522, "uuid": "d733f07a-e0fc-4127-9f15-9653f557b74c", "value": "T1714733E29C58D04EE667B8B2958BC29C204BE8D6C075845F41CDAB4D3ECD8D50FA778E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772992522, "uuid": "ab2c77e2-2802-4e56-b089-d88c74dbddc7", "value": "786432:mBkhIBOzRuFmtlXtDOrsjcFR6O3mkdAFlc:nNuElX/ER6O3mkdl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772992522, "uuid": "d994018a-6181-49d3-8150-a940fb05914a", "value": 25905533, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772992522, "uuid": "8f4f3ebe-e2c4-4031-b320-fe6d447207b4", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772992522, "uuid": "66d60713-db89-427f-922a-018eb788f46c", "value": "Main Setup.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73713246-1b11-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772989719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772989719, "uuid": "df3d1941-20f8-44f5-887f-07bc72b1a72f", "comment": "Malware payload (Mirai)", "value": "4540c6d8805d605137051f808beab6a3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772989719, "uuid": "7f295faa-8127-4b0b-897a-d8d8e0d59edf", "comment": "Malware payload (Mirai)", "value": "a5bad0adf5e96b2eb7c04abc69eaad7c65ddfc05a1ac015cca1bbc353c77c841", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772989719, "uuid": "91da5a04-8f48-4379-97a3-983d016ee89a", "comment": "Malware payload (Mirai)", "value": "b41e353dde443666870d05465678a2ad1020730c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772989719, "uuid": "e36c874e-1f17-4770-ac9f-887fa80add8f", "comment": "Malware payload (Mirai)", "value": "facd68572f3cc4391120a0ebe60677ba56c4a0b25cbcad8773b9699a9c481f60dbec5b7580bb6d81c74ad93a53818407", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772989719, "uuid": "75a03e3f-2c69-46d0-b228-c7d8c4f4c253", "value": "T181F55A62F892DE93C6C05679BE5EC2D877131774D2EF32028C0547283BBB96B0A7B552", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772989719, "uuid": "fd45bea8-17cd-4bb0-8a07-91fd76e681f5", "value": "49152:nQCW49beKvQtcfBldnmn28wUVrr+uNWCQPdZ:BJJvQm4PwmlWCg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772989719, "uuid": "5c659c04-4945-4520-954b-965747ea19b2", "value": 3549544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772989719, "uuid": "6ae2af74-f3ee-43b9-b0f5-2a339a5d4e13", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772989719, "uuid": "bebe6788-f04d-4de1-a034-2381a752079e", "value": "arm-linux-musleabihf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b1ed892-1ae1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772969169, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772969169, "uuid": "ea3b9c02-3e2d-40b7-b092-9c938433e6a2", "comment": "Malware payload", "value": "b77e5f7b14ad16c90e4c6ff62bd210ec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772969169, "uuid": "9f203c4e-566b-4720-b8ce-5b4ecada2709", "comment": "Malware payload", "value": "a769eaa070125ad38353b41c7afa3eff42d8df87e88051c9b1bf8b09c6f602cd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772969169, "uuid": "f97e0ede-1d67-43ea-951c-0cbc6671d14d", "comment": "Malware payload", "value": "2169acc0ca2578ef30bc1675f6b39f4f552f37d7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772969169, "uuid": "9bd00c33-8c63-41bd-b6cf-0334ceb3c707", "comment": "Malware payload", "value": "dfaa7dfb119b46efb8fd47577f4625436502ccf50aaecc57ac2afbd2573033fb9c33e978ff7a199684f40e765e87dc2a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772969169, "uuid": "219a9e19-db65-4e74-a2bf-5349469d4dab", "value": "T155742925134CAE0BD49E6A77D8F2210D63F5E0B4E9D3CB4614809B6C0FD13919E36BAE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772969169, "uuid": "ada9597d-ad1b-482c-a385-ac43e86a8b81", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772969169, "uuid": "0917941b-38f5-4a65-8853-6624f83e2499", "value": "6144:kY9bDtRk5kknWNO4gHNlxkR1emnMXRkTxxlLF8ZNrJz16Z2ZwUfiIha9CzP0Vg:Z9TeX01hFeKU330Vg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772969169, "uuid": "3fdcf7cf-85a3-4334-948c-5ef9d4b90c04", "value": 345840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772969169, "uuid": "880cc8ab-eacb-4c67-8785-8db6d026aa88", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772969169, "uuid": "9f3b6df4-e9b0-4a24-811f-c18850284b35", "value": "Feedback.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0be786bf-1abf-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772954326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772954326, "uuid": "ae31da89-c439-4990-9e4d-c05cb7525a82", "comment": "Malware payload (Mirai)", "value": "6d14ac7951e8b4a4f059d97ff0470ca4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772954326, "uuid": "d35d9c5d-70bd-4004-abf2-fb56dc9607b4", "comment": "Malware payload (Mirai)", "value": "a97ec3794ee02e8c9a22d872152f276274237d11cf132cdab2fa346167bf815f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772954326, "uuid": "d7e18c3e-ef82-407f-b7f2-aac61cd26e89", "comment": "Malware payload (Mirai)", "value": "489cf525d03decee7c5ea1c9f9a0c4874355eefc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772954326, "uuid": "9c19e909-1477-4c48-b0f5-1dc6f723049f", "comment": "Malware payload (Mirai)", "value": "b73859983c380010f7de0247c31077db58d176a2c92a982bf591e1c8f0d53a9ff5e8f41c56f4ce59a859b2f7b0c6f846", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772954326, "uuid": "bd909edd-db41-4cd2-b12e-6593257022b6", "value": "T18693D551BC82562BC5E023BAA67E668D336473E4C2CF722BC8214B257BC561F0C63F95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772954326, "uuid": "47c640b0-5306-4994-a114-a767d223790c", "value": "1536:cd+6IHbLrKZe7C6a4m2qiLM3ZO+XC2zsethxAqrr8GQ:2+6cLrGoL+DhxA+jQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772954326, "uuid": "47cf28a5-e38a-4885-b9f2-bf91b70a6a94", "value": 95720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772954326, "uuid": "880ff791-985e-484d-8963-4256ba046ff9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772954326, "uuid": "940d173a-1785-444f-95ec-ecb28259be76", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "184fd462-1b15-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772991284, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772991284, "uuid": "34dadb48-f54d-4e0e-84e2-f0151fb12727", "comment": "Malware payload (Mirai)", "value": "107fe72f1f373ed5997081aac85eddc1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772991284, "uuid": "e71442ca-fe26-4b23-93c8-7b21022790e0", "comment": "Malware payload (Mirai)", "value": "aa46b4303ee46bc1369441601c3db01dcc1437c896a5529172627b543593d779", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772991284, "uuid": "d2901864-10c6-4bee-8744-693fdb9f10af", "comment": "Malware payload (Mirai)", "value": "e79cf5482ae9ae4c34a0f139d42328aab2361165", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772991284, "uuid": "82323ad1-88aa-4382-8ea5-da80bc2e0ab2", "comment": "Malware payload (Mirai)", "value": "558755d81634804a1836b7882e06f99c747288ebcb2520c935406c6ad1921524d0fd7edff89a1cc5b4f1c29e12f066d8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772991284, "uuid": "dfc01992-3a26-471b-adf0-fe6edc0b864e", "value": "T130D32A06730C0A47D2632EB03A3F67D197AF9AC121E4F640355FAB8A95B1E335586ECD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772991284, "uuid": "106af55e-c7c6-46d4-ab69-11cf555d6ae0", "value": "1536:troGHNTUZNilIBUiCxfytmtewMDNna/w4o7lbEJvAhh3rp+JuQfqAg8703p:3mNUiCxttqCwZ7lLhrIg3p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772991284, "uuid": "ce351a78-5681-48f8-85ba-83f29ff83358", "value": 134036, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772991284, "uuid": "c4d4287c-4475-409d-a543-0544cfcfbc9c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772991284, "uuid": "17635840-9fef-4c2b-8086-feff6da375a8", "value": "main_ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd69fd5b-1b0d-11f1-a769-42010a9c0008", "comment": "Malware payload (NirCmd)", "timestamp": 1772988125, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772988125, "uuid": "d6a87b73-e77c-4710-b225-b320ad4d9777", "comment": "Malware payload (NirCmd)", "value": "c68e06068cf6af021fe7fbeff4c33f17", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NirCmd", "colour": "#A5465F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772988125, "uuid": "24a852db-3324-490e-ac09-61119c5b9cce", "comment": "Malware payload (NirCmd)", "value": "ab49332f1edaf32a65f5010bd3f0eaea4deedbb3ced0c9f3b287bc5107156817", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NirCmd", "colour": "#A5465F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772988125, "uuid": "d6a045e6-21e4-466f-b596-6b59236ddb6f", "comment": "Malware payload (NirCmd)", "value": "df6ae8d59be224a93a12bfa343c23a26d537b86c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NirCmd", "colour": "#A5465F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772988125, "uuid": "cf4c89a8-6bc3-4132-a866-a68c5ebc341f", "comment": "Malware payload (NirCmd)", "value": "e67d2dc5bed495faafd81b22fe62cfa2a5740c41c427853fc9e3d68a0fcf5c3ab0304f63bd1104ed9d73de0af3a0f9d6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NirCmd", "colour": "#A5465F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772988125, "uuid": "d90616a3-e1e5-4ed4-a232-5c6a8b77aaa6", "value": "T113A52342F8C485F3C4511C331B65A7616A7DBE202F268EDBB3856B1DE9614D0EB31AF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772988125, "uuid": "cf0c275a-4839-4ce2-a5c0-dd1009fd6e36", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772988125, "uuid": "263c6925-1adf-48aa-87fc-dcd6ba9cca7a", "value": "49152:ABRETpc8iYM5pF9UBB6jdLXsuuX4/cqZIiQx6lSONx:aeTFM5pXUBB6BLXTuoEXx6lSONx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772988125, "uuid": "77f74128-2d29-4476-9539-0e3743a85985", "value": 2110512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772988125, "uuid": "8ab72fc2-600d-4b87-b61c-b40c41054555", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772988125, "uuid": "b2e592d6-e04d-4391-bfb2-ebc153abfb5a", "value": "random.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43b16cac-1ac7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772957856, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772957856, "uuid": "03b10584-b8b3-47eb-bff0-6052206dd14d", "comment": "Malware payload", "value": "bf8bd02ae24ac14bfd9d0bd098ff40a6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772957856, "uuid": "d56dfd38-e17e-4cdb-893c-fc48f23bbe5c", "comment": "Malware payload", "value": "ac3a7d1e56c6d4bc7df6d5b57cb2ac1c0e57e55cabb0f0e51879f9257f4e0f26", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772957856, "uuid": "79daddb1-f964-4f49-b8d1-8ae1d36466d5", "comment": "Malware payload", "value": "e120032639b5c88d8195885ffc1903c2640c00f2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772957856, "uuid": "d01495c3-eb8a-4498-bd19-f12e6509ffd4", "comment": "Malware payload", "value": "09d0f1aa5a20359aef38db028009d9a0c75154a8ba0ecb2414b87f54874e512a179991966d18227e7baed7279804b6b6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772957856, "uuid": "dedf6011-1ab0-4dd1-b3c6-f4cae1e93a63", "value": "T17253E745BC428B1455EA36FEFF5E029A335717A8E3FA7202DA114F2167CEA4B0F72611", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772957856, "uuid": "49efe7d5-0d7f-4d42-9fc7-01af8bfe7558", "value": "1536:nMn6m9d5lXsxHpddcyR4GeVBpeEK9lS7tkJTSFq34bTh:Q9dIRpVxelpK2I4bTh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772957856, "uuid": "9cc2beb5-f735-48d0-b198-859a020db2c2", "value": 65672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772957856, "uuid": "31c13e78-9210-4e8a-b255-01e2555c484b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772957856, "uuid": "b2543627-93cd-431e-8095-12f632056433", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18441318-1a82-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772928148, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772928148, "uuid": "82c4401c-3020-40e9-a45b-863ee3acd734", "comment": "Malware payload", "value": "326b597358df56aeea69bcb0c892fb9b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772928148, "uuid": "d96180af-3514-43f2-9a31-be7455e7649a", "comment": "Malware payload", "value": "acc233f051c11e0d9bc215bd018a31edc0b95d55094bc44cdb1e4213065a04a5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772928148, "uuid": "332ad4ae-5e7d-46bd-b355-81e519874fbc", "comment": "Malware payload", "value": "ba3fdb57e964075d46d324dee11fbcf4ee4e47b8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772928148, "uuid": "82c3df39-1e4f-4f3e-babf-256493459793", "comment": "Malware payload", "value": "cbafdc67edcd3713c61870b8dff0f0ab26c13a8a9f3b3ffdf657f1f4e2433f0266f9bcfd033000ce0c97bcfde815b327", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772928148, "uuid": "a90632dc-8fec-46c6-b64a-2b66bc62fa07", "value": "T1B4A533EC9CFEDC1DE48C9A7C4D158C80970A1D2BC81B55987593BE12ABF581E22392DF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772928148, "uuid": "f9ed2f0e-8efa-4264-946c-9a5a6dad4555", "value": "49152:sl0gscW6VKeDVhQan8URTHZIApLi9wPUk8ztB:sE6p/C4T5IsUw87tB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772928148, "uuid": "1f688ff6-ff67-42db-a4ae-88ad96a27953", "value": 2207778, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772928148, "uuid": "1a97b25c-6fa4-490e-beca-7bcde8166793", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772928148, "uuid": "224ae0cf-5fc0-4b0e-b264-ded4a89ea448", "value": "Setup_Installer.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fe94fdf-1b11-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772989659, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772989659, "uuid": "496e2d13-65af-4492-92d5-62339b67a45c", "comment": "Malware payload (Mirai)", "value": "7d29f544d882ff599e67fd137c9b231d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772989659, "uuid": "10f06283-42a4-41e2-b100-a97041a15742", "comment": "Malware payload (Mirai)", "value": "ad614a1b17d220cf1edcb84626e86e07c5ec78f14b223c9ff7d4722a4d2c7a55", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772989659, "uuid": "9c272191-325a-44a1-91fd-1e61913f893e", "comment": "Malware payload (Mirai)", "value": "0fed6a95f147a7faebf5855d3d459f76f93e7a3c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772989659, "uuid": "2cdfeefd-6501-41f9-8131-a7205e2f0e00", "comment": "Malware payload (Mirai)", "value": "f43e6d25fbdee0101026e05d9edc5febdae662b9bc47a5108c7b0a41f27b9932689a2c827230814f1013387a1525003a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772989659, "uuid": "0f5270c4-c392-4a69-9ce0-628bf5d35f22", "value": "T1424533CD60491B98AB9D042CA94FC5240E72E97F86E5D640770778D0DB875FBFC2AB81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772989659, "uuid": "c507af52-35b3-409a-94b1-78c620f2850e", "value": "24576:j0LISnZFViU27tP0q8NqhgisXKdgY2zED02FcuG2r/dbaRSNM:IMSzV9yt8q8Nneh4QP7xnM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772989659, "uuid": "869b0982-f1dd-4fcd-9986-3a9ad88eaff5", "value": 1197908, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772989659, "uuid": "db526834-85f9-408b-8a67-2efb8a58cf28", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772989659, "uuid": "9fc80389-c75f-4edb-a2ea-637256a453da", "value": "armeb-linux-musleabihf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a23234b1-1b37-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773006118, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773006118, "uuid": "d92154f8-e29a-49e9-9f79-fe786ac0b17f", "comment": "Malware payload (Mirai)", "value": "26d16affe36775affac7c6c3a4d4d024", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773006118, "uuid": "37e2046b-1a0e-41b1-ad65-fe6f598fd4dd", "comment": "Malware payload (Mirai)", "value": "adacaac19ad73026bef74e11a6c0f6c79af751cc794c0c52d9c0ab0ab1df5dac", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773006118, "uuid": "4de7d1ca-4f57-4d94-a3b7-8c3d03d40649", "comment": "Malware payload (Mirai)", "value": "dfd0d8bbddbba36f994b470f431f313789ca0df0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773006118, "uuid": "fa621a3f-f08d-4994-9bf6-74b759c4674c", "comment": "Malware payload (Mirai)", "value": "44a09226a125174b759237b99e7354ce0f7cef86ee7e85eb2141640679e89023ecce941e20d8ef033b05eac12ac8117f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773006118, "uuid": "41d9f1e3-4e44-43ab-81b9-91f3a2c8414e", "value": "T10C041983E9667E77C1C6EFB462E3DA740BD3E8145B431A4AB1AAD9F00507DCDB804768", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773006118, "uuid": "4c89de1f-3736-4093-acfe-0f3febbe025a", "value": "3072:P2NfbjLLR0NK4RfLWiGFMDVadgDMmECAnYB8Y3RKMZH3JtK:P2NfbjLL0faiPDwkMmECAnYB8Y3RKMZ+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773006118, "uuid": "afc31c50-121c-48d0-81d3-a44a789f235a", "value": 177776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773006118, "uuid": "2beb5906-73f2-4f10-91af-c8e15a67bf62", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773006118, "uuid": "c58a99a3-badf-4ef7-a72a-54a11a443686", "value": "s-h.4-.dick", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d300bd2-1afd-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772981145, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772981145, "uuid": "75e0c4f6-e0d7-4cc6-8c14-8286d7044b2d", "comment": "Malware payload (Mirai)", "value": "8905fe82ed132aa23d134c3fee67ecc5", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772981145, "uuid": "74c75c3d-a787-41f7-b29f-85f7b812fccb", "comment": "Malware payload (Mirai)", "value": "aeea0ea1ba5b0f3362acf93b0c4c6a83e65cef4cd78febbbb7d15dc2e4003957", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772981145, "uuid": "31330777-bb05-4e20-873b-974cd5c70cbc", "comment": "Malware payload (Mirai)", "value": "89dc75336d86962078e8a999539b15c817548233", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772981145, "uuid": "2cc65af9-9445-4a18-af35-2f0d969a7e74", "comment": "Malware payload (Mirai)", "value": "9d6de3ddb4511215059cd2cdb58bad424757424c961e9e372018e9c814045e3a882815f59215e5b11c7c55a8a0c7c104", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772981145, "uuid": "9f8b2bf8-96af-4680-8285-1df23273dae5", "value": "T12D41388CA049D3A297CAAE0F59F3D9D8F06E81D766887DD7CE883EE58C4450C345AEC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772981145, "uuid": "accd04e5-3700-441b-add9-7502f73301d0", "value": "48:oPjnoGm6qUQTvcWOZJHSOI6IcH0bFptCeCCQN5Y:ozoGQUQoWOZJHSObLH0bFCcQg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772981145, "uuid": "83edf0c5-4bab-4afe-adfd-799369d782c0", "value": 2219, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772981145, "uuid": "0e78493a-929f-46b9-9e10-8b94ac33532f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772981145, "uuid": "963bcfb9-8482-46a5-8039-0f3f0390f068", "value": "payload.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1f10563-1b1a-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1772993769, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772993769, "uuid": "abbc688a-c7bd-4976-b9b4-9779921f921a", "comment": "Malware payload (Vidar)", "value": "2ed0aec87d99e89e11977b77c84ffbdf", "object_relation": "md5", "Tag": [ { "name": "app-enekora-com", "colour": "#F0DD0C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772993769, "uuid": "bc81e086-9f86-46b3-b508-cf478e10e1cd", "comment": "Malware payload (Vidar)", "value": "b1fd47ee66afd27e8f0663a77df96051168b93f0ca032bbbb9544d2b5c74150d", "object_relation": "sha256", "Tag": [ { "name": "app-enekora-com", "colour": "#F0DD0C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772993769, "uuid": "0a05d593-3cc2-4bd2-8fe7-4c70f16018f4", "comment": "Malware payload (Vidar)", "value": "14b52d0a77848292b4f41379a3b562a30c0eff71", "object_relation": "sha1", "Tag": [ { "name": "app-enekora-com", "colour": "#F0DD0C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772993769, "uuid": "5debd344-6ad0-48c8-815d-34b40916d0c2", "comment": "Malware payload (Vidar)", "value": "96d6773e79f5255214abd63a2e88bf9b6699da693ba175dd0db02876af6ce92b86db9d4015a16fa5b407e9958c004af1", "object_relation": "sha3-384", "Tag": [ { "name": "app-enekora-com", "colour": "#F0DD0C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772993769, "uuid": "5afbf5bf-2f98-49de-8ab9-f7e5b8a35482", "value": "T131378C927CAD44A9C57EF0389CA042217A723C5557327BC31E96752F0D77AE82B3E728", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772993769, "uuid": "06ebf4c6-f822-460a-82c8-985b8336d9f7", "value": "91802a615b3a5c4bcc05bc5f66a5b219", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772993769, "uuid": "9e4f9dc9-30c3-4d48-b8b2-0caaf3228820", "value": "98304:FdM29r57L7Zv/2Ly63l70DW2EeWrqh9gHpbh:3Mmt7nZv+Lx14SqWGrgz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772993769, "uuid": "26d63594-afc2-492d-80b1-767d8397bdcf", "value": 23261697, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772993769, "uuid": "b192e179-4b38-43ce-bdab-f602610651de", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772993769, "uuid": "af2d6e19-54d7-4986-ab30-23e6f8e7d6be", "value": "Installer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15499ec9-1b15-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772991279, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772991279, "uuid": "4b964aeb-afb5-4925-bc01-f99b7ee025fa", "comment": "Malware payload (Mirai)", "value": "72b10e940f95ba9677219f7726545ebb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772991279, "uuid": "964cf127-e7f1-4b2d-b550-3a4e067d462f", "comment": "Malware payload (Mirai)", "value": "b22ae7391c20c241e08ec2def7c238d7ceb2a40fde9e65db8afa70b010f2a082", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772991279, "uuid": "bdd25d7d-ee03-44c3-8b8c-109a5faa7746", "comment": "Malware payload (Mirai)", "value": "61e16b14cc0c04e7f589606097857057342fa3d4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772991279, "uuid": "c51677ce-5eb9-44af-a481-9850701e2d6e", "comment": "Malware payload (Mirai)", "value": "7bf010d01192b30eabeb71dc5ed4093df53835c891082c14a1555c3f278b4bd108cda65dc102baa35acc7ec513e34733", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772991279, "uuid": "d6cfede0-d2e2-4381-9e8b-1e9906acdfbc", "value": "T127D30945F8504B23C6C611BBFB5E428D3B2A17E8D3EF720399256F60378695B0E3B946", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772991279, "uuid": "a0ee2a54-41f9-400a-bfa0-f96eb7e70555", "value": "1536:UFKdzElm18uZJNb4A6Fa8eAZHk4VB7fzTTr71igYSvGueqZvd2UlqKwyw6RNPYTo:UFKp50VU8e947Lb71izSftBdRalK5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772991279, "uuid": "0730adf2-9186-41cb-bede-497ef84610c4", "value": 133920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772991279, "uuid": "437de385-0ba0-465d-9076-aea5bc2dade7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772991279, "uuid": "3d28e957-a28e-4e2b-8272-b64728444a2a", "value": "main_arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1617792a-1abe-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772953914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953914, "uuid": "5e435d99-8888-4f31-9e35-049b35840154", "comment": "Malware payload", "value": "e3a1401b40ad593c8825f04bf71af979", "object_relation": "md5", "Tag": [ { "name": "DEU", "colour": "#5920A4", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953914, "uuid": "c098393e-978d-4a38-96f8-fc90287beddc", "comment": "Malware payload", "value": "b2746e9ea424aa52974581ac57cef1630c756e892e62f572db28af128b83cff4", "object_relation": "sha256", "Tag": [ { "name": "DEU", "colour": "#5920A4", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953914, "uuid": "58600dc1-5bed-4e53-9564-ed51b2160d2d", "comment": "Malware payload", "value": "51518e2eeb43abf962dd7e5cd746defff92487cc", "object_relation": "sha1", "Tag": [ { "name": "DEU", "colour": "#5920A4", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953914, "uuid": "0ffe511c-2587-41b8-91b2-eeb343a63101", "comment": "Malware payload", "value": "d7a7cb641a662002f3ab781d750910f59f2a44479166025ce681dc15fdfeaf1e5f9b765f694c01d675cc22827d38da9f", "object_relation": "sha3-384", "Tag": [ { "name": "DEU", "colour": "#5920A4", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772953914, "uuid": "acd33432-77e9-4b78-82b2-7413f0a0b59a", "value": "T1BA245311A3FD5208FAF73F84ADB462644E26BCA6ED79D2AC1261104E4AB1F40DDB1737", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772953914, "uuid": "81fedb23-9ae9-457c-9de4-388ecea5202d", "value": "1536:VgJjMv+ziJjOKwMxgYlD5dcxu9DDJZ6STdDyN2yzWW0UD/dbPzxgYlD5dcxu9DDc:VgJjMWuJjOKwMxHH9/1yNk47zxHH9/0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772953914, "uuid": "32d6ffd8-e8d3-42c3-b655-3dff79d06c1c", "value": 220232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772953914, "uuid": "e5a376ce-89af-4e39-882b-a945b4a2ca73", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772953914, "uuid": "0fe8214e-282c-4104-a048-138f0e784cba", "value": "Geldstrafe-20260305-81754_PDF.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b8e7a55-1abd-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1772953547, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953547, "uuid": "9c616a22-e5a5-4aff-879f-3780b2d8d7ce", "comment": "Malware payload (RemcosRAT)", "value": "2a10178d8538ae4d3f47a0253e2ddece", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953547, "uuid": "821ab489-d516-49e3-88ee-ec0fc6b45437", "comment": "Malware payload (RemcosRAT)", "value": "b2c2b1516f59e6a296093b59adff834b4349aedeb05358c7df062edd145a34c0", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953547, "uuid": "b5291eae-4634-41c9-950f-13a59fd8c426", "comment": "Malware payload (RemcosRAT)", "value": "b611e19f45330d5d4ecc7f1a83f4222745642bb2", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953547, "uuid": "cd066d30-9d5d-4bf0-ba1d-62a08ab39cbd", "comment": "Malware payload (RemcosRAT)", "value": "07528c7037dddfb55fcc163d4c0a0c216277da1906df63cafadf2139463505adf3397f1a40bfd527608f59a1c42df374", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772953547, "uuid": "1db1533a-7eea-41c8-9882-ce89bda2bcbe", "value": "T1335517955327D5C18A5E2153F1044FF46E39AB3F2E81F167CB6E3EE834A69C39887488", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772953547, "uuid": "5dea7a9e-ae50-4c7b-b21f-6ffdcc85a1e5", "value": "96:qiMm/lmXyrPNMRj0dYgKI9uoSRi9qrSqGqzMuKW/M99GKTGMHuB5TuIGTea03sa/:ZVcxBPlPq0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772953547, "uuid": "d268f8bf-1e5b-4eb0-ace2-1a30c880b10b", "value": 1402088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772953547, "uuid": "eb6cf5b6-273d-448e-8135-ced2327426c1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772953547, "uuid": "e0417865-73ca-4e95-a7dd-840d6fec56f4", "value": "2a10178d8538ae4d3f47a0253e2ddece.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e175b871-1aa9-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1772945235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772945235, "uuid": "976e481f-79d1-4f4f-a819-dfe7bdeec28a", "comment": "Malware payload (ValleyRAT)", "value": "411fb8f5ba3956146884abe3935786ab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772945235, "uuid": "c83ec184-9f65-442a-94c0-19d213160a6f", "comment": "Malware payload (ValleyRAT)", "value": "b43f405eb92d14c18bc9c4c28207ae3d53bca89077d74acdddcc433857aecd95", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772945235, "uuid": "6d33500c-a63a-4834-b5c6-2236e6208d95", "comment": "Malware payload (ValleyRAT)", "value": "d79097b814bf4ecc4d79289cb7faa8595e56792e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772945235, "uuid": "62dbfe61-b4d6-4c87-8c99-0d23ea022bfb", "comment": "Malware payload (ValleyRAT)", "value": "f80c4b606a487ed7c2cf999ff1d2d73c7f8c4c267070a58a6ea3cd1e8f2ee279bb6b216e3dec4ef3259e71f2694585ec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772945235, "uuid": "a88f457a-9679-4a9f-93e3-0f816125bd87", "value": "T13EA5AD03FAF1F2B8D596C17067058772A631BCCAA5217E7B1AE0B7342E71A514F18B78", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772945235, "uuid": "45b8326d-0a62-4889-902a-4a291236bd2f", "value": "18282fc1904d19b61884a0fe03ef73a4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772945235, "uuid": "f3d82c75-3869-4015-8f79-4ad1d66cd531", "value": "49152:qBgMKTsTrsRs1YtZGtXbqJlbO/lROf4TTBsxX9i8f:qBLxv+ZwLqJlWlIOBY9p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772945235, "uuid": "f234edec-f900-45c8-8d58-ad0302aa9042", "value": 2097664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772945235, "uuid": "02658abe-8500-43ed-941b-243660887142", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772945235, "uuid": "ead23ffd-f137-4e8a-ab80-52bcd53995d8", "value": "PowerPoint.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eccaf561-1b29-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773000230, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773000230, "uuid": "0b4e4cbf-a12c-4022-a901-0c888181aa7e", "comment": "Malware payload (Mirai)", "value": "90c3d191d8644ed06730528a222fb944", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773000230, "uuid": "b7ea7a47-aa13-4969-a4b8-8daacb2d9e1b", "comment": "Malware payload (Mirai)", "value": "b50fac5449d4335cc44922ba97a76d09f1d3d28b0d08b25660872c0e4de148ad", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773000230, "uuid": "ef1f3f2f-b909-449b-8456-95c8156cb844", "comment": "Malware payload (Mirai)", "value": "d9bfb9862fb1f3db621f3e1952358dea3c844e0d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773000230, "uuid": "16f9871e-7249-4f26-98f1-61e3dcbb8cad", "comment": "Malware payload (Mirai)", "value": "946194bae709497c1056f5193c9a2c5a3ca2f91a165ae6f05ff646ef456a9819a7b54e3afe58d324ab3dd502d13098c7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773000230, "uuid": "783ef643-ada8-43df-89c0-022f82cd894d", "value": "T1C3E3F606770D0F03D1532DF0273B2BE097ABFD9629B4B680752EAEC95271DB22446E9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773000230, "uuid": "2b7b0e7f-18be-47e2-93d7-da7ada83660d", "value": "1536:w79mIP53Ij1vjxPiWvbgj4hbbV+RtTy2CHfpE8qIvAqTZWu1NmRmb9ZuoM93:MRabxZbg+bR++2C/pmqd9goMJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773000230, "uuid": "56004440-2ff0-4271-b36f-df1dd4d9d36f", "value": 146940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773000230, "uuid": "52ef6fa3-acae-4bcc-8ecf-ae90a4ca181b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773000230, "uuid": "b38bfeb5-ab82-47b8-94f5-b70f52ad3648", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "422bc1cd-1abd-11f1-a769-42010a9c0008", "comment": "Malware payload (QuasarRAT)", "timestamp": 1772953558, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953558, "uuid": "7ff3a7fc-519e-45f0-8f1d-74886e66c036", "comment": "Malware payload (QuasarRAT)", "value": "9e6d2e2e599fcc56a563e2b7ff45cfc8", "object_relation": "md5", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953558, "uuid": "49c0c583-2ea8-466b-8046-48a8d415de5f", "comment": "Malware payload (QuasarRAT)", "value": "b56d67f497038cfca55a4e7ad62a4f43a2d1267c15cd22094dca9735163bf65d", "object_relation": "sha256", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953558, "uuid": "86134699-36d7-4710-bf59-7ff8fcd6a10f", "comment": "Malware payload (QuasarRAT)", "value": "d8e364d37e685b7684f8fddb5532e3d030c6dca0", "object_relation": "sha1", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953558, "uuid": "ba6d9918-d05c-4b28-9763-792e340c4a74", "comment": "Malware payload (QuasarRAT)", "value": "770b17168a1e5a4014e35758e460650e0086842fe012b3d68d59b6b9121cee44462bef8e3ee2590da00d9bfb51df8ec8", "object_relation": "sha3-384", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772953558, "uuid": "ff303aee-eab0-4dd8-aef0-dcf741368115", "value": "T10F751231C677BD7F0A2C2E4654073DD05C3C6BE742ACC1BBBA8676B7E2A2584CD09660", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772953558, "uuid": "2296b76f-c479-42ab-b3f3-b26ba25108fd", "value": "24576:maaZwHzp81iARucvNDTPIZx3yrfGAYTPrr/WvrLaXxLs46:m1ZfpNDTw3fzrzkrmc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772953558, "uuid": "febac503-e9bf-4a78-aeba-ce3116df2c52", "value": 1610233, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772953558, "uuid": "6d234438-3ecd-4392-bb76-b531f9cd4321", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772953558, "uuid": "b9589969-e713-4293-a379-c46e17dd64ba", "value": "9e6d2e2e599fcc56a563e2b7ff45cfc8.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7846a54-1b33-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773004436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773004436, "uuid": "3456f24e-752a-4d89-9e51-0c3293bf84b8", "comment": "Malware payload (Mirai)", "value": "e36257f60a24837e38985cd5a04c6d67", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773004436, "uuid": "7ef48f90-d598-4ab1-8615-ee4f97385579", "comment": "Malware payload (Mirai)", "value": "b750e32d246444a2d9074aedaa43b81b28efbdc01284ec7808e1f94ec70226d8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773004436, "uuid": "6e9e4f13-8c8c-4757-bea1-8630bbde90d0", "comment": "Malware payload (Mirai)", "value": "181899dd5fb469c6929ec63fb15f37cb941543ca", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773004436, "uuid": "49f790aa-97c2-4fb3-b1c5-5f1f7a3364ff", "comment": "Malware payload (Mirai)", "value": "982f3b42e06141a1ae0478502c1b8a3136fddb386bc6cdb96145ba9dd4fbce807d1ee89dd0c642b035db239b39a87aa2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773004436, "uuid": "4851cab1-40f3-4826-99d6-38a2a74ab50d", "value": "T178934A22BA7A1D27C0C0A47A21F34721F6F247DA25A88A1B7D710E8DFF256503157EF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773004436, "uuid": "efb5a40a-d2c3-442f-a0b8-be923f29cb3a", "value": "1536:S9hBSkm9wX7HSmt2XxJGJd7hnLJpshoOHtt6bN+S5Dvd3iEychotPFk8:S9SF9wXj4yZT2tcbNVDv01tq8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773004436, "uuid": "a61be73d-6f62-4638-a14c-0d255a6054c0", "value": 96504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773004436, "uuid": "24d09b00-d904-4c08-a1ae-16c0d9a573d7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773004436, "uuid": "41a37047-0b56-4d69-951c-96f2172651e4", "value": "spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9e17ae8-1a92-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1772935371, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772935371, "uuid": "d3f8cf58-93fc-418a-9e00-8c34951d3f7d", "comment": "Malware payload (SalatStealer)", "value": "c61767ebd5fbc55f9889d9c8db1be91b", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772935371, "uuid": "bc0d96a7-f614-4332-8fbf-9054dbaec836", "comment": "Malware payload (SalatStealer)", "value": "b79c583c53021e050c1b4a3eee216fb0abc9294a17e6799fc60ec8ba8034f1d6", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772935371, "uuid": "abd552c3-c62c-4141-b307-5bef51049519", "comment": "Malware payload (SalatStealer)", "value": "99dd1625c392f6159811da97a6f835c44cfe85e4", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772935371, "uuid": "6df3a708-a177-43cf-b43d-d6f94b12d20d", "comment": "Malware payload (SalatStealer)", "value": "829c9a239e1067d8b190d80a845a708bc2bf444389b119f3f5516fc1f7ee048d46d27db08f3cea3f37ef5c012f888773", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772935371, "uuid": "3c8bf1f1-7570-4000-9903-4efed706cec5", "value": "T149E53333408F9F87EA104E3D67E056260F39C7DB70D989246738A4BEB7D9398A0F6495", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772935371, "uuid": "e783bdc0-d8f5-46f8-a755-8e7830b646a3", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772935371, "uuid": "be443f56-a1cb-49a2-a812-93c170bd30fc", "value": "98304:SB7m5J/R/nMYdGh/yhdb2/vDekc+LSkoF:USX/5uh/MbCeknSkO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772935371, "uuid": "9dd34b65-8083-4d34-934d-2dd73ec39b72", "value": 3299328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772935371, "uuid": "f6389884-8404-4a6b-9366-e7793bfdbdd4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772935371, "uuid": "f83c0b27-b242-402d-bf40-e5cd7fd50f5b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef854b40-1abb-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772952990, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772952990, "uuid": "cd16a446-1f8c-41c6-86d8-af8a87edf7b7", "comment": "Malware payload", "value": "201a808756ea234893fee20bb524b05c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "txt", "colour": "#BFCC1F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772952990, "uuid": "d3dd2ca5-8013-4719-b206-577c63c623e9", "comment": "Malware payload", "value": "b8e4db27a7347c05c3e9d42a6e04f9bf8ae0b0df6a78fb68c9d818bccd7a68ec", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "txt", "colour": "#BFCC1F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772952990, "uuid": "343d4b9c-247e-42e7-9c78-984856834f0d", "comment": "Malware payload", "value": "48a29e13562467c647793978587b1d92648c83cc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "txt", "colour": "#BFCC1F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772952990, "uuid": "07070c83-9339-498c-a3bd-c183f7907603", "comment": "Malware payload", "value": "ee832fc3b1c150ebca500ae9f136f91c98b4a0b5146f33af2fdad85439b8ec530f1124da771d8a5bbf236d35d69b457c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "txt", "colour": "#BFCC1F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772952990, "uuid": "18de15e8-d841-4802-8111-065bebc2de6c", "value": "T109146B0927E610A6F0B66B7499F102934A3A7C637B7592FF5784803E0E336C4A971F63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772952990, "uuid": "b896fe1c-e159-49d1-9e3b-b551b3888f2c", "value": "9da7080b9b697496fd4f41997e8bd436", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772952990, "uuid": "673f918d-b151-488f-8b96-ef5c96c0bf17", "value": "3072:8RLCJxDxQxsO8lM51B5GWp1icKAArDZz4N9GhbkrNEkOlKn/:NXDxQrbp0yN90QEHK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772952990, "uuid": "12726304-5e62-4fbb-8967-373fb8ca7924", "value": 196608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772952990, "uuid": "9f2578ac-793e-48b8-adfd-c47d8dd0e3f7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772952990, "uuid": "20dcb34a-2802-4b8b-b59c-a17f99d00e7a", "value": "fish.txt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c99c8aa-1abf-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772954327, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772954327, "uuid": "1ec5d946-8a90-4582-a57c-1f4636b47601", "comment": "Malware payload (Mirai)", "value": "6f651ac6b25278b87f6698abd1a7684d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772954327, "uuid": "937cbc8e-0083-4e88-be48-18924f924cfd", "comment": "Malware payload (Mirai)", "value": "ba0aae542414c20619e72b7e2f82d9269d1bee955b93318cc942684358637b24", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772954327, "uuid": "e698042e-270e-4d2d-a4ed-0fb30d4ac549", "comment": "Malware payload (Mirai)", "value": "c155f851301ea2d825ee1839c299e292e73e5021", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772954327, "uuid": "d8307bc1-d446-4abf-996b-a626918af82a", "comment": "Malware payload (Mirai)", "value": "2de36fb7b5cd0b731d5d59b6ff7c3846277bce39791aff176f5b57fcaae79b671416e88d651c185c6e6bd8187b8b0742", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772954327, "uuid": "07e0dd19-20cc-4b52-81c6-0f64fa925e41", "value": "T18704B50E6E198F7CF79987345BB79E31925833872AE1C582E1ACD7105E6024F641FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772954327, "uuid": "71a07b3e-1a3d-4bb5-8b6e-711d6a420f7f", "value": "3072:1OATXjpCgqDJHDexBJKfjPV4kuMu8hJBQX/uw9EfszRpSP/QBrj4jTv3TcJ2tD2Z:1OATXjpCgqDJHDexBJKfjPV4kuMu8hJE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772954327, "uuid": "4436f3aa-0590-41d1-b738-2501ada761dd", "value": 175820, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772954327, "uuid": "9c9a55c0-d41c-46f6-9ceb-2a73c3c77388", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772954327, "uuid": "b8f71796-4288-413f-8b21-6324bad4f699", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06610251-1abe-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1772953887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953887, "uuid": "4a68b55e-3745-4595-be29-14c45c6cf358", "comment": "Malware payload (AgentTesla)", "value": "24ca526bb00a90b2c6281c90d1d1d5e7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953887, "uuid": "5535f890-2a92-4972-b9a3-58bc3ed5ab12", "comment": "Malware payload (AgentTesla)", "value": "ba397e1683ba73229f093eb2e1077dca67167ed30697a757b6086fa25d7961b1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953887, "uuid": "ca6c5165-d673-4e89-9e25-670cffa9f537", "comment": "Malware payload (AgentTesla)", "value": "5c771f4350edebc8659cbfab387b5d9726576c88", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953887, "uuid": "fd3174ab-e800-4dd5-9457-dbb3126be00c", "comment": "Malware payload (AgentTesla)", "value": "4d5eb28e260c89c83de57dbe056ff0876f55a80b6f5ed71bf8b96245b0b782cb0f933c49a0445971e3d84d9140922d23", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772953887, "uuid": "f1a48609-c569-4a4d-9997-040d0542e759", "value": "T16A4503BC141493B8D9EEC5E6C6C52F84F80EDBB8FC25941CB830A6D7EDCB4AB4564618", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772953887, "uuid": "f97b8733-7be8-41d9-af18-e42b0b5e8847", "value": "192:XF9x4AoDLFYg17DuYsHK/wUHZPZqasWQb/v1HBT+4LWpIWUlWWjxrECgy2jd3YxJ:NXo/OZr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772953887, "uuid": "e4e7228c-40c6-4f65-9a04-8720ef890d44", "value": 1243004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772953887, "uuid": "37cb8e40-8063-4441-b70f-2929a359ed3a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772953887, "uuid": "dcc76ea0-6ac4-4ad5-9e54-189a6ddab955", "value": "24ca526bb00a90b2c6281c90d1d1d5e7.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2177ed5d-1aff-11f1-a769-42010a9c0008", "comment": "Malware payload (QuasarRAT)", "timestamp": 1772981850, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772981850, "uuid": "12ced708-44ab-4f44-88f6-dca21906d004", "comment": "Malware payload (QuasarRAT)", "value": "01169e45c035f262f4389d167f9d5971", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772981850, "uuid": "622eba17-6cdb-4673-a34b-fe4252f60045", "comment": "Malware payload (QuasarRAT)", "value": "bad3fd1928ee1d2f626ca26a343c0fef3cd37f19937f15e73b26f163adadf65b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772981850, "uuid": "06315348-a8e7-44b6-a9f8-fc8de6a550d1", "comment": "Malware payload (QuasarRAT)", "value": "02ff3dd780dcecc0dcb5e4d7a2fb3f08c9eddcff", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772981850, "uuid": "b0ed6228-4386-41d6-b1ed-58065afb2e1f", "comment": "Malware payload (QuasarRAT)", "value": "ba290a98d8724d86b5e426d407097aface9b6523585e7f8fe3a01077024bc8ebf8007584b8eaa2e28eef367555ba9518", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772981850, "uuid": "ed99a34e-b086-43cc-b65d-772c664491cd", "value": "T113748D2327A8E97BD6FE077AF432460447B1DA47B216F38B995C52B86C133868D513B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772981850, "uuid": "6dfe572c-0f55-4f93-84f5-59ae9085c715", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772981850, "uuid": "d7f193b5-806c-49c5-85e2-c2be1aa9d7a2", "value": "6144:J2EHwNHJsa2ppNaAObWokOg3fOSgZCkSWXYwBEY4T:wxpsa5AHfOaXImPY4T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772981850, "uuid": "ea2504d9-f481-48f5-8ee7-c179ce948a57", "value": 356352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772981850, "uuid": "0892ee70-f262-4d72-ab09-92e3e7d48bb6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772981850, "uuid": "f0666aa2-7113-4b95-a078-a5bc3a26ea0a", "value": "x.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a193102d-1b4a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773014277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773014277, "uuid": "5277865e-ad3e-491a-8f55-01038c2037b1", "comment": "Malware payload (Mirai)", "value": "4871947287d7cf659d43ed9d0ae6b442", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773014277, "uuid": "b287f0b1-3054-4552-a74a-23fcfbcbd947", "comment": "Malware payload (Mirai)", "value": "bb0c309bbb270137f2f67789afebd2b8a4c50d3eddb8bd1427b6877477b6040e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773014277, "uuid": "07634af2-1a08-427f-9df7-f983aab2facf", "comment": "Malware payload (Mirai)", "value": "063a12ec66d5b15fb37a4cd1f1216d50886372bf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773014277, "uuid": "153b48ae-5c1c-419a-87d0-fdfbcc0779f3", "comment": "Malware payload (Mirai)", "value": "d2e6453972f9f1e9c808181ec9ceadad920544b4745674885a40331b36462e4e91fcad5a544203e3733c3208645cff6e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773014277, "uuid": "241370ea-97e1-4b2a-9902-7872a674d757", "value": "T1F7C32859F881AB02D4C625BAFF4E418933531B6CE3EA7202DE248B3533CEA5B4F76515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773014277, "uuid": "3834cadd-7abd-43bd-bfc1-bb6218b40734", "value": "3072:c/okIF8WYAOaDbeK+MH+eZ5afIchLcpPM6H:llbOaDbeK+y+enDcBcpPbH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773014277, "uuid": "92a60794-00b5-4025-98eb-ac0a024aecb9", "value": 120292, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773014277, "uuid": "43c77e11-a959-4d0f-ad82-f3e4d8d9355e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773014277, "uuid": "39eafd13-2038-4820-8176-9ae9426f8085", "value": "violetarm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d12df2ce-1b35-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773005338, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773005338, "uuid": "49f01330-206e-4258-b828-91470fba35be", "comment": "Malware payload (Mirai)", "value": "b2ca1cf8b98f8f8da623d89ed16914a3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773005338, "uuid": "ab8ee5d0-812f-4cf6-bd90-5d72dcde17e5", "comment": "Malware payload (Mirai)", "value": "bb3c3ed806e4cd68ae6119c6337a93c7711986694eebec287c33e9308913fc3d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773005338, "uuid": "0f327773-1c6e-4786-a70f-96dbd85c5d71", "comment": "Malware payload (Mirai)", "value": "5864a26e9247367b5cd60ab122b26c332e66cc3d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773005338, "uuid": "9eb5f1e6-fc35-4de7-99bd-8a65cd021383", "comment": "Malware payload (Mirai)", "value": "93ee0ab82fc72b4d2f8ae744d15f51fcf6f1101bca4d0c70abed078d88606ad3951e49fdca8430b4402e0f3d42d93986", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773005338, "uuid": "1716d7d9-bdb5-43d6-b183-6cf2226d651f", "value": "T12523F19BCDA05746C7BB9D76729E92F29F4852D0D0FB27350B928DC021A2D0B249D8F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773005338, "uuid": "119b2c6a-a699-460d-94d0-a8fa5ea020cb", "value": "768:QdNqQjJge6Pb7KY1aKzD+o6TEgsho0uCukXtNX4K38vVYpVPgSWiM:Qj7Jl6Pnv1Esh6atFEVEKCM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773005338, "uuid": "c68f8ee4-1fa2-4561-897f-6f2411ec9548", "value": 46692, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773005338, "uuid": "5a6f0511-0866-45a5-a5dd-d0187bdc2b07", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773005338, "uuid": "c802cb20-8694-4c8c-85bb-c4a04d1e1a96", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e91b2a3-1aa0-11f1-a769-42010a9c0008", "comment": "Malware payload (EternalRocks)", "timestamp": 1772941043, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772941043, "uuid": "60822499-0dbd-4616-bea2-b2bc8dc39f79", "comment": "Malware payload (EternalRocks)", "value": "cc60c228344e667705d7ffd736bd7b7c", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "EternalRocks", "colour": "#8EC11F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772941043, "uuid": "77a98174-91a0-466a-b53d-5716e8081c15", "comment": "Malware payload (EternalRocks)", "value": "bb53ed713fb58562a60454dad92aad835d77e6b99ed21e8b323df817ae202ead", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "EternalRocks", "colour": "#8EC11F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772941043, "uuid": "0895d064-98de-4d4d-a3b3-2580a766c60a", "comment": "Malware payload (EternalRocks)", "value": "98816559368409aaf71f9a67772ed180414628bd", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "EternalRocks", "colour": "#8EC11F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772941043, "uuid": "f14b4f39-fe5e-4519-ba2c-46e213f22ace", "comment": "Malware payload (EternalRocks)", "value": "1a463b55fd80de02388dc6b5cb1deaf8ab56a03919ea4c6aad70404ca81692939427d992d5fb0c0145a2249096ffaad3", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "EternalRocks", "colour": "#8EC11F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772941043, "uuid": "bec31e4e-0e30-4185-9824-1c8844a3a132", "value": "T108557C9162DB37B1E067B7BA8C2F061FD371B8186F31C2CB0294AAAB5D37BD15539241", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772941043, "uuid": "b908cb13-fa68-4a4b-befd-2a3f1642c7e8", "value": "852ec43dcb17f7e28f66f45401010ff6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772941043, "uuid": "ef1822af-0247-426f-9ae0-b0e016ccdb22", "value": "24576:u1cH5C7iB0uIXQgY2AxHsNWjMbBJ7ZZijtyDRc0clhym:5B0ZXQgnAxMw6BvQjtyDRc0Ah", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772941043, "uuid": "bbd39745-f825-4ff3-92bd-23af5eedfa3e", "value": 1325568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772941043, "uuid": "b73108ab-d176-4a2a-941a-29d04ddbce24", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772941043, "uuid": "5972d900-616d-4ec7-a9e3-15d4e0635525", "value": "SecuriteInfo.com.Win32.MalwareX-gen.59542767", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7df32554-1af6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772978140, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772978140, "uuid": "c6d8aeb9-3a86-448c-a88a-e58ec6d93ea2", "comment": "Malware payload", "value": "e5fa56295e14db8a3516f3d3fa761fef", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772978140, "uuid": "b19413b0-bde1-45e6-94fc-3d1f5b1a6b18", "comment": "Malware payload", "value": "bb8694eb9d551d6bfef282f696f893032641dc9b6d9de3e0c26375873be7c394", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772978140, "uuid": "80bf84fe-8a1e-4961-9b3f-c05fc8655844", "comment": "Malware payload", "value": "32a1bd9acce53280b33eaa17e4db87f579d75779", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772978140, "uuid": "5e3ec5d1-1d02-4334-9fda-ac4d1f3ebed3", "comment": "Malware payload", "value": "2bddc3924ee93442df25a6d97115626b4e1e673512227eb4e9d5ed7041cd21ac58e01c2bc0201ab7152dbe4f843ac90e", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772978140, "uuid": "8345ea95-826e-4559-af3f-ee800fc173a6", "value": "T1BD925BA916496C79BBC0CE7D9F3C7F0CADE4C1C02219A39CBA4F39715A2069DDA0535D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772978140, "uuid": "500a7203-49fd-4a2c-b26b-75af38e2aa54", "value": "384:dyc0M3vgRjGlsaq7jzsO9a4cbddrME8jyfzsO9a4cbddrME8jy4:dyGmjfXzsP4cbddr7zsP4cbddrk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772978140, "uuid": "5eddc025-8769-48e3-a9a1-ca1f13813e30", "value": 19499, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772978140, "uuid": "d6a728e9-0449-45c1-84fd-fa3033ae823c", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772978140, "uuid": "7c2ecdd3-7cd4-4f42-9977-4cf373b91a50", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91a426fe-1b2c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773001366, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773001366, "uuid": "d23398b7-7967-427f-a3eb-dfe7e4143fc6", "comment": "Malware payload (Mirai)", "value": "cb9f1acfae58d07ba3c6528133a396ac", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773001366, "uuid": "11c587c0-5dc5-486c-92ae-2a74c13eeb00", "comment": "Malware payload (Mirai)", "value": "bc115804e9b9fd929990334eabc813878ced2a6de12fd5c15debbaac9acc5936", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773001366, "uuid": "4f277a6c-bfe5-477b-bbd5-c30ea59e0741", "comment": "Malware payload (Mirai)", "value": "034073596dbcfac5cb8a06c5fc7052a351d5a1c6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773001366, "uuid": "35880e93-f101-419c-91e4-9af6769c7ed8", "comment": "Malware payload (Mirai)", "value": "38f271e64097c2c9022d78174f342a1d496f69d93eea6f61d1ca111940506936916ba33211c79ebe04a18778f329ffc8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773001366, "uuid": "b47a4fe4-47aa-4ad5-8a74-dd155fe6572b", "value": "T165041AC3A9667E77C1C6EFB562E3DA740BD3E9105B431A49B1AADAF00547CCCB805368", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773001366, "uuid": "7c5b71a4-8d56-45fc-b50c-033da9095244", "value": "3072:5rAZBkxsHdN1RuVWmXhf3mCjxGIqmsCAnYB8YKrKMZH3JtK:5rAZBkx00gmXtmXmsCAnYB8YKrKMZH3u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773001366, "uuid": "520cc92a-a56f-4916-bb2b-871bd406d115", "value": 177581, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773001366, "uuid": "a1f923ae-c0fb-4ebc-920c-87ea4c61822e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773001366, "uuid": "8a1f9b6c-3bfa-4f56-a4c4-077bff9b5608", "value": "s-h.4-.dick", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52ea1b92-1abe-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772954016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772954016, "uuid": "b87c283b-4575-46fe-9879-ca18bde630f3", "comment": "Malware payload", "value": "cbd0c8207234040931d5356a2d45e2cc", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772954016, "uuid": "d2fff51c-cd23-4c05-8411-a360064be39c", "comment": "Malware payload", "value": "bd0704c8c22ec15c5d9240fcd53b3e2d18104326fc8af87c0de1d8a3e53d0f20", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772954016, "uuid": "1b8397c3-181c-4a81-889f-24f827064ead", "comment": "Malware payload", "value": "08e32f05f76b343779e741daf20b7aaa8cdf899a", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772954016, "uuid": "f653bdf6-d343-417c-82e1-c0328f5dc92a", "comment": "Malware payload", "value": "7825b4471f8e1a68977477ebebd0f2fe62f56a74fcc45f3020dec1e072a9ea430b7f356ff2e20c32218ecbddc7f83d2d", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772954016, "uuid": "7c301ad3-7168-4f13-b178-dac939b70b58", "value": "T17CB2348C3ECA747A0272643B7D1FB11AE12F8C46F09C50A5C6527699FF64338D1BAE58", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772954016, "uuid": "57843afd-7d02-4d47-96a7-61237a98fc58", "value": "384:vNxQ0A+eY+a87GDSFWv59KERnpEzfTiMoUG9CSBT6DGhF6HE:1W0A+eY+aSWB99xpuvoUG9Nwxk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772954016, "uuid": "9ad2caf6-2bd7-48b9-9d64-a45574de22fc", "value": 24151, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772954016, "uuid": "6f972f37-769e-45a0-bde1-8236d8d286d4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772954016, "uuid": "49df6ced-ddea-4181-bd98-696f41b685fe", "value": "cbd0c8207234040931d5356a2d45e2cc.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcf7cb68-1b23-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772997573, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772997573, "uuid": "dc085b82-b0fe-4183-ad06-512521768412", "comment": "Malware payload", "value": "da1738b17fe3d8ceb095c8cd1424bb9d", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772997573, "uuid": "b5e5bb2a-ecb0-4749-87f1-cfae2e91ad72", "comment": "Malware payload", "value": "bd2ffc3e22d5b20114546fbdef591ae3ebb3873f3caac0e0471526a08e9659d3", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772997573, "uuid": "3e73e4ec-2410-44d4-8e64-4ae84a975817", "comment": "Malware payload", "value": "9b8bd41df22a6de40ea626c784ce101f60093441", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772997573, "uuid": "dfdf3cb8-c203-40b8-bff2-d7604ac63b49", "comment": "Malware payload", "value": "ed54dfd5b9eb2cc3419528aebdb99dec6b4ea97cc52405e0386d356e39411d166ad6eb83910759a0d1d93f02dba096b7", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772997573, "uuid": "9c201ae0-a627-4305-a7d7-31e1c0cdb5a0", "value": "T154D0973EA614859080A4AA6CB02CF0DBDA8FA68A1E5CE6101A9C899074100A742BE4AA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772997573, "uuid": "08497f3a-7d50-425c-b431-79c9e9142e67", "value": "6:eliUil9MyzpMoDgAfd27zVWlrOhMFI1R3KrO7:eUFlKyziIgudEWZOhMgkrO7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772997573, "uuid": "d953feac-b30b-4ad5-8618-6d8cab854c2f", "value": 251, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772997573, "uuid": "60cff225-fae4-4923-a68f-43b9a1aebede", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772997573, "uuid": "c19238a5-86e4-4fb9-aed4-d0a3a971f3a8", "value": "load.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4be0e05d-1b25-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772998242, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772998242, "uuid": "a5c4fe7b-5ae7-4029-a5ab-c70b473cbd1b", "comment": "Malware payload (Mirai)", "value": "8447550471f543e849c2fdf346b496fb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772998242, "uuid": "28008a60-4250-4c5e-8a60-f9d27ff8da4f", "comment": "Malware payload (Mirai)", "value": "be016ca4dd640e1b3e8b7aa5cdfd25dcea380588d0f21cbe4b043f70624af307", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772998242, "uuid": "7f188564-781f-4ed0-99a7-058abe20f32b", "comment": "Malware payload (Mirai)", "value": "8447f50e62e295c1a4a5882b69b8639fac3d1f46", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772998242, "uuid": "338b8b1b-1e83-4803-9354-24e20a5d2db7", "comment": "Malware payload (Mirai)", "value": "01429d0555339907d3fbbb4f76b229470fef47e4f05272bb59ec26d0ccf18daf8e0fe19648bf4edee1e232a38d5845be", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772998242, "uuid": "dc4bca0f-5299-43da-b2ab-2640f5eabff2", "value": "T1DC4496553E22FFBBF599C73047B3CA2046D925953BD19785F29CD7181E2028E680FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772998242, "uuid": "8314b625-96b9-4096-9439-34b8e5aba491", "value": "6144:PZWPFe8RrrueNwtY6R3z+mU5oZNxPeHyJ0/6lqI1:SgorV+Z+mU5oZNxmHyJ0/6lqI1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772998242, "uuid": "bbb9b3f0-ce15-4c93-9397-97dfdd794e4c", "value": 262646, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772998242, "uuid": "64358f34-8b03-478b-a31b-b41a6bdd3514", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772998242, "uuid": "5261fb0b-d079-4b4e-951a-81ad29f37ac0", "value": "m-i.p-s.dick", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e527308-1abf-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772954384, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772954384, "uuid": "0d73a756-6f60-4701-9e7b-0fa2136da5e3", "comment": "Malware payload (Mirai)", "value": "acd2f4c184bb17f369dd292db02d65b0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772954384, "uuid": "cf8f53d1-4f1a-4ac2-8c28-bdb61c97db8e", "comment": "Malware payload (Mirai)", "value": "be2f466f6f56e69a50dfd5d93c5baae9762201baa72fc1d9274cc6eb61323672", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772954384, "uuid": "c30a9193-319a-406f-9cb9-10f9e7f8ae2e", "comment": "Malware payload (Mirai)", "value": "c71065fa07779f631bb94426353f48646e8d4b4f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772954384, "uuid": "86117a39-81db-469c-a602-910c45e97370", "comment": "Malware payload (Mirai)", "value": "ad7788fdf8e605c0d47e9fd820ed57e19f6fed3984155df3a5561701c5eb6d579f7a3861ad7ebc5b8531ce983d17c008", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772954384, "uuid": "19f6dbc4-1a68-4bdb-b0e4-039307211bf0", "value": "T1C6B339C0EA47D4F5DD1642302277F73B9A32F17A1139DA83E3A89F327C52A41D90A29D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772954384, "uuid": "651452bf-6fe1-4e42-a8fa-b61acc838193", "value": "3072:XFmzGpEWmXBLFkpzjYS3Z/5+JcDEh3ohHw0pJbLB:XFmzY5mXBypzjYYZ/5+JilHLB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772954384, "uuid": "e8fd9634-d475-43a8-b9b6-f689aa647bdd", "value": 107824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772954384, "uuid": "8fc99059-3cd9-4d4b-ba27-fae854817412", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772954384, "uuid": "8d188a91-dc66-4bd5-a970-c5494be80735", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0dedb30a-1abd-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772953471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953471, "uuid": "c7116e49-6885-4046-8daa-2e0486a519eb", "comment": "Malware payload", "value": "4999efed7397536355c5d353283240c8", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953471, "uuid": "4c7380f8-8547-4a74-8ffb-a0e3e5a48912", "comment": "Malware payload", "value": "bee1f85acc47382c2ed67c7bb636dff411965e5bdb0e105f44469f3bf05fa812", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953471, "uuid": "7fa2957c-bd47-4f87-8453-6114caf9fcc9", "comment": "Malware payload", "value": "335b5653c41ded701fdde74651a15e120094dcd4", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953471, "uuid": "87f6031b-9de3-4700-956e-6387a365a40f", "comment": "Malware payload", "value": "aa1ca5202a9e638d67b781cbb3f60bcdc4665951f7e78975ab526c933a1dcafeb6dc412e72b03fd7df05846326c1d041", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772953471, "uuid": "b523490d-3710-4220-b1ab-52937e3b5a22", "value": "T14FC15C9076F44B48E0B25F39B5767791C865BE24DE31CB8C2314944E0CB1791E8E5F6E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772953471, "uuid": "c52e0dbc-05ae-4141-92d2-76faeadbdb46", "value": "12:8d/MkEkEkTs0olPfVUlmv4SlPo6qs8XleAsni7X/ir+eXqlhM6VenpwKKblu+ssN:8d/MxxLPfOAPfq1tii7vHe6rUgsnP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772953471, "uuid": "b9db4a05-1fa4-46ee-855d-42fad2982719", "value": 6110, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772953471, "uuid": "b141528f-753f-4edc-af55-8c3e927d4ca0", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772953471, "uuid": "48c5ed9e-5ae8-459f-b605-629478daca8b", "value": "02.26_qurtal.docx.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eae44c04-1abc-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1772953412, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953412, "uuid": "12d12aab-6e25-428c-85a4-5792e1ae96de", "comment": "Malware payload (RemcosRAT)", "value": "eafe3d1ae502190656f4d29bdaf9891a", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953412, "uuid": "f3843d59-0dff-446f-a173-b7e9d8310d05", "comment": "Malware payload (RemcosRAT)", "value": "bff445a3db366091b2dbbfb1c072514a2e0a480b1e3e44a3fb926a080ad23baa", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953412, "uuid": "43c4a7f3-6984-4b01-8e3c-45f764f4fb89", "comment": "Malware payload (RemcosRAT)", "value": "55103c827aff778a7dec006c0bb5d12c254705de", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953412, "uuid": "f28610ea-54b5-4605-8347-0b16ee018056", "comment": "Malware payload (RemcosRAT)", "value": "d642ff01ec55a825401fe0c61143c40d67ef006099891ab0eea02f34286afbce539bc1941f3e0332f35806b59106611e", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772953412, "uuid": "eff21197-c6ad-4d07-b9ac-7e8a2a046a00", "value": "T1D4450998DD5567C91B97241130E0575B4E3B52207BB768ECE2E874CFE802E8DF9A4BE0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772953412, "uuid": "628a1279-df99-4a58-8235-0225c822cba4", "value": "192:38pc57hq8ZYLE8ty8fouy8gE8QU8UKH8J+2gv8HggSUTSY8Uhu7f8FlHrScP8h7g:F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772953412, "uuid": "0cdca1ea-a400-4fb3-a02a-a445538529a7", "value": 1184501, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772953412, "uuid": "98e1430b-aaee-4e86-ac83-65474afbf933", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772953412, "uuid": "b2d1b926-7caa-4981-9da7-62bb3ea1ec7b", "value": "eafe3d1ae502190656f4d29bdaf9891a.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d7bc642-1abd-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1772953685, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953685, "uuid": "660a4ca6-8464-4e72-af17-fad52801b81c", "comment": "Malware payload (AgentTesla)", "value": "d05f93f40ca6b38158201bfb5e5d21c3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953685, "uuid": "65beef4f-ba63-48d6-98b7-ed30ce3d6aed", "comment": "Malware payload (AgentTesla)", "value": "c086688a200de5b7721cf6d7e1d82460ebed9553c70b1e71a68d9749518f5e10", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953685, "uuid": "fbe9ad7c-44ee-4add-9eda-d6833b77b499", "comment": "Malware payload (AgentTesla)", "value": "e090a39ac8f12d9acbecd92e7b7296daa921d118", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953685, "uuid": "3f20c02a-ce1a-4fd5-8bab-1c21c13b06d3", "comment": "Malware payload (AgentTesla)", "value": "d125ef62a8961f388229111b488a655b2c9074e0c006162b61319861af082f503f8ed1dd73f5362c61fb6a1d1956a018", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772953685, "uuid": "b8e351d0-45c0-4491-bff3-7358b3ce988e", "value": "T1E7C2544E3DC1B0746F23F4339A2FA63AE12E7D45668CC08D97675018F92DB08D576AE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772953685, "uuid": "d54dcfc1-83df-4172-ab23-10eb78d34525", "value": "384:oSE7n10LhB57lET4OYlb0+LMFafZcYrD/F2g/MTcqHy9I+IWG7GRbRl:I710LT5hET4Ok0+LMKZcYrZ28gcIVyl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772953685, "uuid": "e02fcfbf-76ef-4ae6-bd32-feca2af9266a", "value": 26211, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772953685, "uuid": "3ae1676c-c71c-4f28-89df-e0a5da6c7a05", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772953685, "uuid": "47a2244c-39d6-4db0-bf0b-8ed6a238b1bb", "value": "d05f93f40ca6b38158201bfb5e5d21c3.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78272eb9-1abd-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1772953649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953649, "uuid": "764ccf59-63e1-4fd7-91cb-42c0c498ead6", "comment": "Malware payload (AgentTesla)", "value": "88436bccdc86534f61a5296b3e86c281", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953649, "uuid": "c6be2fab-9365-4e35-8e0e-fbca460dc736", "comment": "Malware payload (AgentTesla)", "value": "c17af4c1815ba54f90c65c2c330ee403a63d327c5d5b16c77b2b75a433407694", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953649, "uuid": "7b899e65-0d52-4888-b99c-76c2b7944c45", "comment": "Malware payload (AgentTesla)", "value": "9d2a4d0626520b31313c46c3cbf1068698a559ff", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953649, "uuid": "70828264-e38f-463b-8ae0-bf0cdb94cdbb", "comment": "Malware payload (AgentTesla)", "value": "a45aaa5f7c04e0aea7f5a8632aff4935fd7f1a9d8fbb827ee8b19ae90f8746facb7366bdce01c8becd2b0670a20a5586", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772953649, "uuid": "c3f77792-0211-4d51-bed4-18dc00965960", "value": "T15F45A32BE272F2346BE16FEA8F19B7405E306319531BA4B93F0489EDC51E364DD93A50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772953649, "uuid": "d8eeaf87-68a3-40b4-b46f-e371e6c95978", "value": "192:EAMAMAMAMAMAMAMAMAMAMAMAMAMAMAMAMAMAMAMAMAMAMAMAMAMAMAMAMAMAMAMT:QMM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772953649, "uuid": "0d719f7f-3976-4d9c-862a-8bea9f8a58e2", "value": 1205796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772953649, "uuid": "1ff5a494-b60d-4db9-9496-8ec42fa0969d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772953649, "uuid": "93b95aaf-553c-4c29-ad2b-96acdf5499c2", "value": "88436bccdc86534f61a5296b3e86c281.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "061c31aa-1ae0-11f1-a769-42010a9c0008", "comment": "Malware payload (RustyStealer)", "timestamp": 1772968490, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772968490, "uuid": "ebdaf2f0-d657-4d72-91ab-c1eaf7428deb", "comment": "Malware payload (RustyStealer)", "value": "27ff752e0312170d8bb2a3058edd6b95", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772968490, "uuid": "541e179e-75bb-499c-abfa-8ca126c4aaf2", "comment": "Malware payload (RustyStealer)", "value": "c1cba18928da95e8ef20e12f26b64ac7a5fc9ff3c92614ab909c395f9c7f9198", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772968490, "uuid": "84074738-f950-427a-b834-c0ff22f7c432", "comment": "Malware payload (RustyStealer)", "value": "7c0aa19fbcfcc0470e5ad7f02504991e7419df9d", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772968490, "uuid": "1b75474c-d567-477c-a1de-1c3da475caea", "comment": "Malware payload (RustyStealer)", "value": "c2684c4a8907adeb018c4a1962ca1fe74f424ebf494f4f87dda60f3e30c4d8f6d2447bcb26d3bbf9b7dccf8ac61c0abb", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772968490, "uuid": "ff227123-2773-4bec-ac46-394c9cfd90b8", "value": "T1BF1628217F5999AEC05AC074C2878B726A3270CB0B34BAFF448456783F69AF55F3D258", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772968490, "uuid": "04ea250b-42c2-4aba-83e7-162aa36a5f53", "value": "98fc41773fa3dfd07c605c5f756de872", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772968490, "uuid": "da5a1ebc-f52e-4679-b550-3131d4b990a1", "value": "49152:7PbKJgMO+YOADts81PVPtCfhMvJhNYfx9J9sUPmUaW1m3pYK2mlaJyTa8j5rRp9Z:CyTjqz5ekK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772968490, "uuid": "f611df9b-2204-40a8-a1ab-97c610e6963f", "value": 4063232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772968490, "uuid": "80aa5a93-7c2f-4774-896d-594cc447cfaa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772968490, "uuid": "837ca7d4-9c84-4a06-a18f-5afeec002d4c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7667b7c3-1b32-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773003897, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773003897, "uuid": "122685a8-1aaa-4cb6-ae16-4813e7c962f4", "comment": "Malware payload", "value": "997bed70aaa7326edc3021c2fb91a1dc", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773003897, "uuid": "2d979f4a-5c3d-4063-ad5a-77caf3dd176f", "comment": "Malware payload", "value": "c2252998610d6675f71765e8a14074188cc917cb75fc2a04e20a45126250abad", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773003897, "uuid": "edcfed14-673f-4cb2-9755-378d63b6f062", "comment": "Malware payload", "value": "f86088b11868e06415111a33fff1c1a864d519a2", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773003897, "uuid": "9ae6a35b-3261-4e48-8554-1161faa9c56e", "comment": "Malware payload", "value": "a22a1069e2cb69e8109a9290db11548aabae2769acbe39b7033036ea1036ba4ce9b204109a1cd962c7f6913b4fc2ca49", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773003897, "uuid": "b0fd962d-df2c-43aa-9ebe-1c572ccd843f", "value": "T1BF925DB512896C79FBD1CE399F3C7F4DADE8C2C42124A3ACBA0F39215A1166DC705349", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773003897, "uuid": "9021d2eb-5ef8-426e-a305-bed2eba01f55", "value": "384:FFcuQpWx+BL0SWL0gZzsO9a4cbddrME8jyfzsO9a4cbddrME8jy4:FF8i+BL0SI0OzsP4cbddr7zsP4cbddrk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773003897, "uuid": "12a7dd33-155d-4324-aa99-66f53d9f9301", "value": 19499, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773003897, "uuid": "63ec4400-a643-4916-8cbd-d23f5f9dcffd", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773003897, "uuid": "ca68ef42-6e87-4b2d-9db8-6d7b023ee6a5", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11749d7b-1b18-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1772992561, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772992561, "uuid": "1d8d9991-076c-469b-892c-7b23b7abcd2a", "comment": "Malware payload (ACRStealer)", "value": "a5c21df47e82d2fbe8b2976e1a597ca6", "object_relation": "md5", "Tag": [ { "name": "46-149-72-226", "colour": "#F2DF1B", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772992561, "uuid": "833f603b-8d8e-4f93-98ae-27955a468377", "comment": "Malware payload (ACRStealer)", "value": "c4627fbcce87136d2ec6fdb876b8c4496d7f25411d2c24860ba1ec0f8f39e916", "object_relation": "sha256", "Tag": [ { "name": "46-149-72-226", "colour": "#F2DF1B", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772992561, "uuid": "c720078b-ef01-4900-bc04-f3b8eb924c7a", "comment": "Malware payload (ACRStealer)", "value": "d0ed305d98c68df54324f6cec17980382c9f91df", "object_relation": "sha1", "Tag": [ { "name": "46-149-72-226", "colour": "#F2DF1B", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772992561, "uuid": "061fdb17-d3fe-4594-a306-d6770fe92a83", "comment": "Malware payload (ACRStealer)", "value": "f19262b91fd30d38ff5bd3b5808d3d33ef0a92c977c64b4930ed07f565eb64ba2807acddfb522b5f906dbdc24c2f7c94", "object_relation": "sha3-384", "Tag": [ { "name": "46-149-72-226", "colour": "#F2DF1B", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772992561, "uuid": "8fa92304-15b1-4710-86bc-2e8449e44b73", "value": "T10ED68E239D908178E5C651FA86FEBB79896D8D06033981C3A5C83C967F719E2363E707", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772992561, "uuid": "cb1fae72-da50-4995-9db4-d693fdb80ce0", "value": "0bf4447fda89303e8c2644bb6df92eb9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772992561, "uuid": "50e81c3c-6f91-4800-85cf-3ff28d69ca79", "value": "196608:5Qke5A05AXFN3delxDtPAFGfcn+hr7EALXn:5YA0aFsDXcn+B7XLXn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772992561, "uuid": "e0add9b3-9fcc-43f4-83ca-34d49adb92e6", "value": 13374224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772992561, "uuid": "82e65ae1-b07e-4980-895e-cad5e938597d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772992561, "uuid": "def56329-4802-4200-b2c9-f2f6939c5670", "value": "wke.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "181b2550-1abd-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772953488, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953488, "uuid": "c2e6db3b-34da-42e7-99b2-984fb8c0a148", "comment": "Malware payload", "value": "b7dbe708ab69e2071be23d1b6197b2c2", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953488, "uuid": "aaeaf1b2-746e-442b-af27-11e7d305e030", "comment": "Malware payload", "value": "c4bcb47a829ffd14b93b4b709cd41068548dce08a251d0cf86fa04f9f0b4db5f", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953488, "uuid": "a379a5c5-852c-4b18-a17b-f8dc3073e031", "comment": "Malware payload", "value": "c039c14a3c96254d7704c9138be38decac3e17bc", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953488, "uuid": "4acd2671-b24d-42d3-aab3-a166f1ecad04", "comment": "Malware payload", "value": "00a4f1ff8a60f622c05fa117d8a73762ec5a8fc82e6924c4594ed56314b6087bb7b53c3fdb9764ad3c26e58ed8ac47e4", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772953488, "uuid": "04c274e2-52ad-4b1f-9808-7c1d9fb887e5", "value": "T10772843AF609DFF40B2E52D0014B7D06A15457A6B53A4ABCB8CDC1987F267508FA78EC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772953488, "uuid": "21e4c406-19ef-4fa6-9623-da588be5dbbc", "value": "384:vkvk1LVMM9J8iwt7igzmRIPRWNUjWXJdYDK6:vYoNT8imnPRWNYs6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772953488, "uuid": "8c57f540-73d8-4ee1-9172-5586e8233367", "value": 17562, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772953488, "uuid": "c808cd35-44bd-4b3d-a822-5f875e2e0d31", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772953488, "uuid": "9dfe46b8-2f2c-45e9-994e-8df4b05b0c8e", "value": "b7dbe708ab69e2071be23d1b6197b2c2.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f515aaa-1abd-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772953553, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953553, "uuid": "d370be98-5d23-48e6-9435-7b0a04324414", "comment": "Malware payload", "value": "5418c904c94aa92cc7ab5bfb42fb6585", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953553, "uuid": "ffef7562-1ab2-48a4-a796-fd41968be1b9", "comment": "Malware payload", "value": "c6507730d015f2d3981e7df3c353fe5a4092d5787e4091b46762eed076789cf3", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953553, "uuid": "81a6d731-cb1a-4db7-9f45-270c28cde8d1", "comment": "Malware payload", "value": "02b58e9e5372501441ead40cef16ea0a5f3a149d", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953553, "uuid": "ca5a0c8b-5ba6-4006-86a9-10a681ecdf2e", "comment": "Malware payload", "value": "83afd2880d87ff981ea14aa4b0f3174af1355d940437d37e1ad5021d7ab2d2496b7392276aed34a8a7caddcfa352819a", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772953553, "uuid": "eca80091-1371-4af4-a25f-754771755a60", "value": "T11695A6181FEB84AF75A37E5041E0525B5BBBFAABA6718B4F048003CD07B3508525EFB6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772953553, "uuid": "adb8d97f-56ca-43d9-84ef-2b7f6992167f", "value": "6144:RHXnHBmJuqVK1kcqypkygapwA8q57mnLbReVGJIM3RttP+nwdIik5RwSR3wn2kt0:hlhq0kbapwXUGbRsHM381R4809Fc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772953553, "uuid": "1ad182dd-d6bb-4289-ab2e-5ca64fc1a3d8", "value": 1878382, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772953553, "uuid": "d5261958-d5ce-42f7-abe2-814a5d8b8d1e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772953553, "uuid": "feaec4af-4503-4f43-9464-3ac8933da220", "value": "polif.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77253877-1abb-11f1-a769-42010a9c0008", "comment": "Malware payload (CryptOne)", "timestamp": 1772952788, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772952788, "uuid": "fbfe8f6c-132b-4b16-b030-8a0cbf50144d", "comment": "Malware payload (CryptOne)", "value": "078113b22b6d51edbeebea0b81345bd9", "object_relation": "md5", "Tag": [ { "name": "CryptOne", "colour": "#62260A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772952788, "uuid": "aa12795d-a795-46c9-be7a-4d2d14e8fa17", "comment": "Malware payload (CryptOne)", "value": "c7233acab36a2cccb3462733fdff00dae5ad4ef8ca953f624a096edab4124ecc", "object_relation": "sha256", "Tag": [ { "name": "CryptOne", "colour": "#62260A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772952788, "uuid": "efa278d7-fe83-4e4a-909f-2cd0394d7ebe", "comment": "Malware payload (CryptOne)", "value": "cafd9665e3a7e0a68084f5ca2c6bd4f7cbf98e34", "object_relation": "sha1", "Tag": [ { "name": "CryptOne", "colour": "#62260A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772952788, "uuid": "be0b997e-3bf0-46a0-b5e4-aa3f281a15fc", "comment": "Malware payload (CryptOne)", "value": "94c2bcc48d541f1bc854efb051c30d6c19a8a14c48608b3b899b70cda08f3b5a32a407d179f49244af7da9b95f5eab07", "object_relation": "sha3-384", "Tag": [ { "name": "CryptOne", "colour": "#62260A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772952788, "uuid": "3045dd9f-1096-4dcf-a7dd-6c5c5a91bafe", "value": "T11446026E3ADA96B3CCA1E43F6B04C84FE11B14632E24B11F75E81DCF96D86152CA4877", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772952788, "uuid": "0ea09544-be50-45f2-a9af-96464fffea2d", "value": "e8450cd9fde12fe86ba788a327b66219", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772952788, "uuid": "b873129c-04b9-4469-b6fc-ed7db8edbdcc", "value": "98304:uxJV6R2B5OnIa7TeNw7J4t6uTtiSnyG79ra/GHq2Z4tMo1hh:MP6s0nIa7TOw7Ct6uTt9H7ZaeHq/tz17", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772952788, "uuid": "e3aa376a-bd81-4743-9d32-be7ae01f43f5", "value": 5815808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772952788, "uuid": "454d4c4a-6662-4e72-b7bc-dbe33b1450b1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772952788, "uuid": "9b8b0aec-37fb-4210-8d9a-246a79da00df", "value": "2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d1176ab-1b31-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773003291, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773003291, "uuid": "371be9fd-3c14-4e2a-bb00-5de25ae6f547", "comment": "Malware payload", "value": "59694d7c215b60d2bc58778213d5e31a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773003291, "uuid": "400463d3-8763-4cac-ae53-4d882faa52bb", "comment": "Malware payload", "value": "c83a786460a558da2fc0f41b145ae5de16ea19e6541f2040a6c341e0c585620e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773003291, "uuid": "75b9f929-b798-4acb-9482-cbb7e67cfa57", "comment": "Malware payload", "value": "820e20a005c7489395e12153e4af9713fba57e02", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773003291, "uuid": "014d30bc-56d1-4825-86d9-df05f35b8ff9", "comment": "Malware payload", "value": "187636a8f7c8c2ad9d8d71b500a05effaabe3006d8fbf418d619eb3094c0c5bfaa88796d02f07d4e02db186f6bbd2489", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773003291, "uuid": "bdd7c10f-3d87-4bc7-83a1-4c961e694cc5", "value": "T18624F881B9117F73C1C3ABB6F79FC2953B726A5497DB3301A969BEB01F0668D0E29101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773003291, "uuid": "aee003e4-806e-4f91-b169-24028f37b75c", "value": "6144:gODKxqS4gevjkbYNLbeTFsWmp0N8YNKZHJcmemGwFl+:gOAqS4gEqU4mp0N86KBJcmemGwFl+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773003291, "uuid": "6931993d-b817-4fdd-993b-1180d0576c70", "value": 211898, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773003291, "uuid": "d3ba428b-561c-4b76-a0a5-3edc57784c1c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773003291, "uuid": "e0514315-e85d-4645-8638-2b62a005d0d4", "value": "p-p.c-.dick", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43d6341f-1b0d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772987921, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772987921, "uuid": "629ea0f6-dbc1-49d9-b9b9-346be6272f69", "comment": "Malware payload", "value": "11d79e3be0ec5796bdfe8a5a5f842344", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772987921, "uuid": "6445d795-761a-4776-ab1e-ceb6545f0490", "comment": "Malware payload", "value": "c85fbd62427921429f6ba9ae17955a1bfcbab78459147485c885c2a292d62ca3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772987921, "uuid": "c496bfb0-7d4b-4b08-883b-379d75adc542", "comment": "Malware payload", "value": "1e99cfbc7dad30f211b49a9bdf3158ccc6fe4192", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772987921, "uuid": "518c28c3-8327-45bd-b77b-715b64d7fc83", "comment": "Malware payload", "value": "f1b67fbad27e1547ce5be11d77fce8f9c539fedbc78f5a8ffd30f0a9cd6b3f5379f8591905243ea42f768781209b33f0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772987921, "uuid": "6ea0484f-698d-4df9-b563-85ae85c97ff6", "value": "T106E48D46A7E401F8E0F7D278C8A24A06E7777C5507709B8F03E4967A2F772A19E39721", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772987921, "uuid": "80f0e875-531f-4c46-accb-09aa83444168", "value": "3e47cdb8c05891e153e1a0018a0ef512", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772987921, "uuid": "974a3b82-c9c3-4d08-ac54-a2f0f90ad910", "value": "12288:46QHyya9APoCZDvgHkMLKCBe3Lo/XBYU744mBa6Q1R8mEuUe7wg:rtyYkMmCcSRYU7to0SuH7wg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772987921, "uuid": "ce282a13-97e9-4421-9cdc-1e7e1f411309", "value": 721920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772987921, "uuid": "8eb282d8-8e06-4faf-bd7c-6b52966ad0da", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772987921, "uuid": "d3216cb0-c107-4733-b767-36269a056f0f", "value": "11d79e3be0ec5796bdfe8a5a5f842344.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fad0d3e-1b1a-11f1-a769-42010a9c0008", "comment": "Malware payload (EpsilonStealer)", "timestamp": 1772993658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772993658, "uuid": "768e0125-d2f7-4ff3-9c7a-7d6a125c08a2", "comment": "Malware payload (EpsilonStealer)", "value": "d0e8bf96e6068b7228894a932c45a364", "object_relation": "md5", "Tag": [ { "name": "EpsilonStealer", "colour": "#559F06", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772993658, "uuid": "5b002313-2bd8-41e3-b330-86f615f8c3d2", "comment": "Malware payload (EpsilonStealer)", "value": "c8a2e4865149c50ed685c7e0c2efb3a70a4e68a343e7fa1b96d569ecbf5bdc02", "object_relation": "sha256", "Tag": [ { "name": "EpsilonStealer", "colour": "#559F06", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772993658, "uuid": "67586d84-0c8d-422c-b048-818ca0606b1d", "comment": "Malware payload (EpsilonStealer)", "value": "32f651aa2422f38825859708be8f33a1c46f70f7", "object_relation": "sha1", "Tag": [ { "name": "EpsilonStealer", "colour": "#559F06", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772993658, "uuid": "4e6544f2-3950-4883-82eb-38fbee7a793d", "comment": "Malware payload (EpsilonStealer)", "value": "8285a5abe9e8cc7cc3624858017b61a92759d1203704955290d55588222dbc6fbbbb902fc6b7b2328bec6f9677425ab7", "object_relation": "sha3-384", "Tag": [ { "name": "EpsilonStealer", "colour": "#559F06", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772993658, "uuid": "7a669e7b-bee1-46ef-b3fa-fb260e64f313", "value": "T1520833FDA393A772EF46253B2AF159722E2C47DE4950D8D3817B64B2DB51C820C9E02D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772993658, "uuid": "a8409010-d4f1-41fd-98c7-6215782c982c", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772993658, "uuid": "76545de8-448d-48eb-b64f-fe9fa5708422", "value": "1572864:WSnyLU23CzpQRL6MXNOUTrhJWBBkQw14U2Ap0E2Mq40LNUib95cyZR0p:WeyLUSRPGirp4MNWUO95cyZSp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772993658, "uuid": "8640d42e-e370-4d85-9b03-ef5d04381d71", "value": 84138466, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772993658, "uuid": "0d45df90-e6a4-49ed-8d09-fbe77d5fc0a9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772993658, "uuid": "16129db6-16ae-49af-8ce1-ee3f608b82cb", "value": "gitlol", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95508fe3-1a8a-11f1-a769-42010a9c0008", "comment": "Malware payload (SantaStealer)", "timestamp": 1772931793, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772931793, "uuid": "adfaef18-c412-4945-8939-576ad476a2f1", "comment": "Malware payload (SantaStealer)", "value": "ff181fa7384dc9668a3e1ad7287e2c16", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772931793, "uuid": "33e466f4-3341-414e-9c98-2055044b3b10", "comment": "Malware payload (SantaStealer)", "value": "c8f181f5233d1cf0a2ccf4cb7335c6e8b7d4c7dc18ae32a73295d829e79197c7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772931793, "uuid": "23ee85d8-746f-4aff-849b-54a0e880b6d6", "comment": "Malware payload (SantaStealer)", "value": "e8f6b2fe2c5898f801e5a11f182391a0e7b7e2cb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772931793, "uuid": "6a17b9a1-77f8-4e41-8a3a-f71afd9dc88f", "comment": "Malware payload (SantaStealer)", "value": "cff0f21470f0eb7b5c4e6e623c55efc75bd3db85813b9a3b01e3944ee91f058175fddc3e895e0ebc20e46aa536c7bac7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772931793, "uuid": "01296bc3-5bb7-4d28-8e25-1f86f64e0e2a", "value": "T12C2633D932C3CE6ECC9BA4319EBB56B65ABD2804C0F9425417CFF694224BDC0095EED6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772931793, "uuid": "f4ef830a-d154-4b58-91f0-dab0cdef8fa5", "value": "459038dd913bd7fa2746dd2acf101131", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772931793, "uuid": "2ddf3c60-c6ad-44b0-bb4b-1147bf59e61a", "value": "98304:xquSGhjAhbVjjfgT4MSUCXKcnO10IJbvShprgRdldLIrSC:xqunjAhpj0TLcnQ04bvS/qrs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772931793, "uuid": "9b9a01b7-4c87-4b03-a1ce-47597ba6fb1b", "value": 4546560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772931793, "uuid": "7b85a548-023a-4543-89a4-dfc7dfe82a3b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772931793, "uuid": "efe7ceed-d7a8-4761-b4ee-8c75956f509f", "value": "SecuriteInfo.com.Trojan.PWS.Stealer.44341.22444.23353", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b072ae3-1b11-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772989704, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772989704, "uuid": "1d2b4ac4-373d-43d4-885b-7feff7a13e0b", "comment": "Malware payload (Mirai)", "value": "177584d4669da0cc381627b39de6de54", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772989704, "uuid": "c0fde142-9a44-44e9-95b2-852bb390a063", "comment": "Malware payload (Mirai)", "value": "ca11ddc0228cfcb255728345bf3d0840d2b6d25374adc7fffde55eede7f0136e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772989704, "uuid": "e704d539-fd31-4c03-806b-f67636d2026c", "comment": "Malware payload (Mirai)", "value": "d5108e85f9267d4160e451f3f7f46441d198960f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772989704, "uuid": "8b240a55-42e6-41de-874f-508e1930aedc", "comment": "Malware payload (Mirai)", "value": "6b1275c0935b6ef2cd2a875e47e085d24494dc3bd8e83bb1eb0ddb445e74da69df2e092be9503a221d39a30d4b37861c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772989704, "uuid": "aa556903-0a37-4072-9a17-84c59e6a5491", "value": "T17CF55A62F891DE93C6C0567ABE5EC2D877131774D2EF72028C0547283BBB96B0A7B152", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772989704, "uuid": "e67ab545-e153-468c-b7c4-6deb07449907", "value": "49152:A2NWYlKePvQFIXpOwdnB+vnIfkr+vVWCQPA:b00vQZyqnfsWCV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772989704, "uuid": "e2581d39-20bd-4454-8d7b-f0dd7508829c", "value": 3549544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772989704, "uuid": "e2e4878d-a201-4dc4-b2f7-86441dc2c9ed", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772989704, "uuid": "a319fda9-65e1-44aa-9808-db4ca0f6fcb8", "value": "armv7l-linux-musleabihf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd61caab-1b18-11f1-a769-42010a9c0008", "comment": "Malware payload (Smoke Loader)", "timestamp": 1772992956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772992956, "uuid": "865137ba-8800-4686-9c07-7cc9766ac7c0", "comment": "Malware payload (Smoke Loader)", "value": "fef30a3520def696cc0d4a1578b6c91c", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "baxe-pics", "colour": "#3BA02F", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-5924", "colour": "#3339F5", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772992956, "uuid": "ee0367d7-038d-4723-a0a7-41cece8a7b65", "comment": "Malware payload (Smoke Loader)", "value": "cab97705a40600d2422d7ad9bd260e6a1aeb883e79b7dc347eab1ee48fb5ce96", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "baxe-pics", "colour": "#3BA02F", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-5924", "colour": "#3339F5", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772992956, "uuid": "8e70ab9e-b572-4494-8c2e-858d9f244005", "comment": "Malware payload (Smoke Loader)", "value": "7967ef8346cb0e5c4778c27bd9ae29e19afc348a", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "baxe-pics", "colour": "#3BA02F", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-5924", "colour": "#3339F5", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772992956, "uuid": "78d7e059-1b69-4ecf-9af3-9d19ececb768", "comment": "Malware payload (Smoke Loader)", "value": "2ccee76e6f176a0f396f46b66faa1dfe136370050648efbe11482d7b1383f24025360a88e89d81ffed6a0c699708dfae", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "baxe-pics", "colour": "#3BA02F", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-5924", "colour": "#3339F5", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772992956, "uuid": "a0f66b51-6621-4def-b40f-23eccfbb03c6", "value": "T1E6E633EF63C0229F15C1664A0F201D4974E1F1DF2A3CEE6A46B6569D7BE580B4F1AF80", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772992956, "uuid": "370f2240-b98b-438f-953d-bcc249d4a435", "value": "393216:5a24MDVrHHdOW49VoqjhcsHyTaSotLjSo3:5IIVrHH8I+O9oV/3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772992956, "uuid": "bc53d430-2c0a-46de-9251-c52ffea8640a", "value": 14744003, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772992956, "uuid": "ab55c719-9e28-45c6-a162-83fd3ebf3e64", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772992956, "uuid": "97e9385d-dbed-4bc3-b9ed-a847cdddd2f2", "value": "source code of carbanak backdoor discovered.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "940c9136-1a94-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772936086, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772936086, "uuid": "e7a8e4e1-0f16-4b02-be14-f92f08fd9733", "comment": "Malware payload (Mirai)", "value": "f346aabb8e009631000aed3cf9fa5683", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772936086, "uuid": "203269b8-eecc-43aa-860a-4c54b7570058", "comment": "Malware payload (Mirai)", "value": "cabaa08c53680732e6857bb1c73a7378446de791d0379d3a8021732af26a85c2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772936086, "uuid": "439b984c-9318-416e-b09e-b47e0c5b2dce", "comment": "Malware payload (Mirai)", "value": "a44892d8510251e8299a0dd917ab5a728f5f3918", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772936086, "uuid": "ac248d0f-85dc-4dff-a8ed-6043f34aa387", "comment": "Malware payload (Mirai)", "value": "7b295bd1a4a8e4a968cc09830c25297aca10eba9bb0857518e18226fe9246c5285b95a21f13bc5d9f64e5ea2ff45364a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772936086, "uuid": "341d21e8-178b-4243-80fc-95e200dd2957", "value": "T130B32A4AF9819B12D5C622BEFA1E518D336347B8D3EE3203DD14AF2537CA96B0A77501", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772936086, "uuid": "5043dee3-3393-43ab-8851-5e942931acab", "value": "3072:4FnKZkAg+D4StJUJoL7zEqAacitsbUVwH3qXwCLZmcJEC:4mg+bJUJA7zRAacitsbUyHjCh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772936086, "uuid": "55ab6a2d-ba49-4231-9513-9ae79431d82a", "value": 109108, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772936086, "uuid": "3a6a1208-09bf-4125-9f5b-2129c0e444c6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772936086, "uuid": "b854e380-e6f7-49de-9d7c-992b4db4d6a4", "value": "tul.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ce4de65-1abd-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772953549, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953549, "uuid": "b63197ae-07ec-4d53-a811-11955cf0c060", "comment": "Malware payload", "value": "b668a3b9e88adda5122b30e90a167496", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953549, "uuid": "1854ffd3-c624-472a-b883-c930f0e053c3", "comment": "Malware payload", "value": "cae90c653338f4d061a56dd28157dc323689276a002828e41591b1b235443c11", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953549, "uuid": "351f6f96-9ebe-44c2-9c21-8ffef9528d00", "comment": "Malware payload", "value": "c022583d08a0310dba56ed4b750c203a0299faf0", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953549, "uuid": "2332de1f-e1d8-453b-b5fa-099d74b13ae1", "comment": "Malware payload", "value": "7629ac0c76bf2a807e9901ffeb6843125993f6a85650765c47d35a675d333e0435c66e7faeee08eaf92c754e20067b6e", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772953549, "uuid": "d98e0b83-5c1f-4684-9602-29c6dff8cd4b", "value": "T1A6456276A7CF0C0CD6F190D2F4E95DD016B0E0F98E2E96C7AD616ED893940D1E22F899", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772953549, "uuid": "ed89d34e-e5a2-4869-852f-b3d6786f5deb", "value": "192:Ebm0MsFURcHVJKz/B1DRexuhxrglM45ikeoxx8Ib12Y54APT64h9NnYbJQ4hAx9s:LlCNg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772953549, "uuid": "0f8a4b31-b446-4ba2-b68b-8f67543d91f2", "value": 1261768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772953549, "uuid": "3b953859-3b55-4300-9c3e-f98aa637633e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772953549, "uuid": "3817a453-8ff2-4cd7-8739-cbaaa8a37158", "value": "b668a3b9e88adda5122b30e90a167496.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d04b3dd4-1b46-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773012638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773012638, "uuid": "f0c11d03-66d9-4df5-bed4-d35714c8ba6a", "comment": "Malware payload", "value": "f23113899eced4521c82e6fb0c25c0db", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773012638, "uuid": "949cf178-2089-4591-ae32-8977f00c5dc1", "comment": "Malware payload", "value": "cc42bbefd45caca5a4fb0e772de8e51c0d3cccbfe4c7b645e007bdc2dd701ad6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773012638, "uuid": "97209941-90fa-4e60-9826-0e116e3ce7fd", "comment": "Malware payload", "value": "fea4db8a3e48f7c02d1cc60fed5d1eefd84da462", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773012638, "uuid": "4df743cd-8519-400e-bfa2-141e500de3eb", "comment": "Malware payload", "value": "b94c0792e362b35baacfff4cc4c4409c267e7e9cd47bffb9be2fe336a4cc2cac48304cbebc790055a0a9752cff43cf53", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773012638, "uuid": "bc417119-8352-4644-9493-c669778cead9", "value": "T16E566C07EC9115E5C1EEE2308A729152BA717C486B3523D76B60F7392FB3BD06AB9710", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773012638, "uuid": "1c1056ea-30e1-48c9-bebf-046dc464eaf9", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773012638, "uuid": "85119ff3-4c05-4c80-a988-d3d3a2f998d9", "value": "49152:EXzj4PB0kRwy5Mslo9Lnu69wS3XKpM+LDeaswoYjZjMehOwKeK9KE/bUiop85E:EuuLDHKq+vhIDzUiopuE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773012638, "uuid": "1c4bf727-328b-46da-8c5f-daa349d8cc01", "value": 5884416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773012638, "uuid": "1b0a3327-b6d0-40e4-b176-2aa7f4333033", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773012638, "uuid": "eb5472ed-6068-4c86-80c0-1bf9e9d02bee", "value": "SecuriteInfo.com.FileRepMalware.41417277", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e5bdb6f-1abd-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772953498, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953498, "uuid": "0635e4d3-a4db-491c-b3d5-8401cf2c7f6d", "comment": "Malware payload", "value": "11d7d5072f651b9440d86b635833665d", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953498, "uuid": "e737303f-d7a1-4493-b6b9-4481f7d3f367", "comment": "Malware payload", "value": "ccb14c7c554f1df5f14c67081847a8e8b28d94fb771e91dfc32d64cb52214ddd", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953498, "uuid": "30b7cb60-faea-412c-86f2-9c80ffe5f85b", "comment": "Malware payload", "value": "a51e17bbaf4ace3342a9c9bcb356b571166916f9", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953498, "uuid": "8871b8a3-0b23-44fc-82b8-f16f9db111a4", "comment": "Malware payload", "value": "cfbd5b63ed7000f86554d3b95b1b3dd5c280ee177cd49e2768305a08c0f2e0eadf53381badfe339b6f52182d0969dd54", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772953498, "uuid": "996eb173-fbe8-4ef2-8570-710e55a3016f", "value": "T16782A71A8D099FF00A7E3111B66B682769100362F938395D7D4FC8AD7F36A54CBD11EE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772953498, "uuid": "35883440-ffeb-4f12-b3dc-d4c6357e3e4b", "value": "384:KjdSoRdO7zok9m5sp+7DChXD+tFl24+zrheBFCXNcya59KBkXEWP:KR11HBDYzQoPdG9ZEWP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772953498, "uuid": "8108b152-955e-4169-81e7-868608b5d4cf", "value": 18081, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772953498, "uuid": "227d0f44-3436-4323-994c-25bcfad72d09", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772953498, "uuid": "2fd19754-e443-419b-b4e7-c52449973a95", "value": "11d7d5072f651b9440d86b635833665d.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a3330d5-1abe-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772953921, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953921, "uuid": "4470b6e0-3866-4de6-9edc-b1996ffeeb46", "comment": "Malware payload", "value": "60354937ce3a251015c345f0b653f553", "object_relation": "md5", "Tag": [ { "name": "DEU", "colour": "#5920A4", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953921, "uuid": "b97ec38a-389a-42eb-a94d-bb142f3d7cc2", "comment": "Malware payload", "value": "ce029cd7446fbb056e2805d5c9a3cbb55c5d6f2c1cf762bf6363bc1bffdf2b18", "object_relation": "sha256", "Tag": [ { "name": "DEU", "colour": "#5920A4", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953921, "uuid": "0e0fb2b1-2155-4ec6-b1b3-63cdd61ded31", "comment": "Malware payload", "value": "efaa6a9b4eb1e0a95f80b5e9993648a8c2ff59cb", "object_relation": "sha1", "Tag": [ { "name": "DEU", "colour": "#5920A4", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953921, "uuid": "c158a6ae-7d4e-46d4-8879-d5732778f0c4", "comment": "Malware payload", "value": "c707151e37999dae939765cb84943e331adbfaff539c5da12dd7a704cad4da31bdd439692f1f77d2e2c05cc22a758b86", "object_relation": "sha3-384", "Tag": [ { "name": "DEU", "colour": "#5920A4", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772953921, "uuid": "54640a81-8e41-4152-836a-8971981e841c", "value": "T1A9047611A3FD5208F6F73F84ADB462645E36BCA6AD79D2AC1261004E4AB2F40DDB1737", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772953921, "uuid": "c380a8dc-5d9f-43f0-9df1-e3e7dc5c9c22", "value": "1536:9+3CBLKb3C/eST6pXzqGd2vn5gNlzFQiUVzscG7Va6pXzqGd2vnZ:9+3CBLm3C/eST6pjUgZQFRGpa6pj8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772953921, "uuid": "c2d1429f-6f09-48a2-a8fb-856602d5dd38", "value": 188020, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772953921, "uuid": "2f7c6642-0138-4b9a-a69a-f2aaaa339b5d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772953921, "uuid": "814805b5-bf19-4830-853b-d8c6550bf705", "value": "Geldstrafe-20260305-81807_PDF.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebbfac7e-1aba-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772952554, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772952554, "uuid": "3274c317-bcd8-4328-9260-6792ec283e9f", "comment": "Malware payload", "value": "53b9d555d08bcfb0f4a1948412a80e99", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772952554, "uuid": "47a4b8d5-90a3-4dd1-ac15-12e061abcdde", "comment": "Malware payload", "value": "cefc707af7a9f7546584f79442b403beec6e4a31f30817045f5e02406e768006", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772952554, "uuid": "88caff55-572b-4279-bb2a-0effcd3746e3", "comment": "Malware payload", "value": "d02e0d6dc7aef9ed220fa6fa349acaa8d4d584f9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772952554, "uuid": "f3c7a685-0555-4ef9-83f3-1689ff15204b", "comment": "Malware payload", "value": "4986d936fc4a2326f305562fa58020219c1dd46eba96b465bdc050409491234fc96afa5919f95ed1a03a0ee7cee2dd31", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772952554, "uuid": "16c5255e-74c6-487e-8101-3edb73fc3d9f", "value": "T1E232C0629DA17E71D48F00B345FD8F61EBB19E3C49C60750CD345695F15D301837BA1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772952554, "uuid": "cd5761e1-ef3a-443b-84c5-b431be70a843", "value": "192:oPYqAWapJRKa5benHaLLzH3ylgwXJek+murLQDodIvikBrNlLL71YQ49Ll:oPYvWKRpkA3ylgrFNQ0ivnrNluQ8R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772952554, "uuid": "24365928-47ef-4297-a7e5-700e5fc17a91", "value": 11917, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772952554, "uuid": "716e3e7d-60b5-4963-9523-9ab534caeaf8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772952554, "uuid": "1c354c5c-2543-40dd-9003-f39084abc48d", "value": "53b9d555d08bcfb0f4a1948412a80e99.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "570c77bc-1b1d-11f1-a769-42010a9c0008", "comment": "Malware payload (GoLoader)", "timestamp": 1772994825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772994825, "uuid": "bc955ff9-3b29-41b8-9203-495786fde766", "comment": "Malware payload (GoLoader)", "value": "e795a82b17ed8db6565b65f5e68c75d3", "object_relation": "md5", "Tag": [ { "name": "dropped-by-smokeloader", "colour": "#3EC35B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoLoader", "colour": "#20E63E", "exportable": true, "hide_tag": false }, { "name": "italiaregina-it", "colour": "#76AE80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772994825, "uuid": "2749cd5e-c6b9-4260-9c06-247e5785dc72", "comment": "Malware payload (GoLoader)", "value": "cefc90917d06cf395c0d745166eb4cf339ccfed306cd56ed13daf676ee70f4b3", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-smokeloader", "colour": "#3EC35B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoLoader", "colour": "#20E63E", "exportable": true, "hide_tag": false }, { "name": "italiaregina-it", "colour": "#76AE80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772994825, "uuid": "9bfeca0f-6c5e-429f-8cf6-62187e037f9d", "comment": "Malware payload (GoLoader)", "value": "8a3c5df40194f67493483b1995f41854cc615bda", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-smokeloader", "colour": "#3EC35B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoLoader", "colour": "#20E63E", "exportable": true, "hide_tag": false }, { "name": "italiaregina-it", "colour": "#76AE80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772994825, "uuid": "7d036a91-cd25-4ccc-a1ed-b92ef74fccfe", "comment": "Malware payload (GoLoader)", "value": "231665d0c9902c5f7403ce74a3a497c2a1c50e6fdcc6fa20a1280a34649da513bf940f9bdbfa024e96d54da32f38dd5a", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-smokeloader", "colour": "#3EC35B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoLoader", "colour": "#20E63E", "exportable": true, "hide_tag": false }, { "name": "italiaregina-it", "colour": "#76AE80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772994825, "uuid": "fe9b61ed-c646-44a8-b233-03f243742557", "value": "T120755A03BCD065B9D5AAD2328DB212A17730F85E0B3177C72E55A7B82E7A3D41E39394", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772994825, "uuid": "1ce4a3d8-b183-470c-9ffa-d463e92fa56b", "value": "f0ea7b7844bbc5bfa9bb32efdcea957c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772994825, "uuid": "0bae0fd9-7fd3-44e1-8528-a98e13956083", "value": "24576:xjmLJeIq8F7HCMECRQKv0JPobL5Y1zOcsYgt8dZkK1V:xaLJeIRFDRQKM9ouMYgtYkK1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772994825, "uuid": "93b41364-298e-417f-aeb0-dcbe24e9599b", "value": 1662976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772994825, "uuid": "f75b65b1-783e-4694-bd3a-ec7a405ef487", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772994825, "uuid": "95c6c79e-ec1e-453d-81ac-2f9ce7b65ae3", "value": "CWnRdEbo.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ea30e69-1b19-11f1-a769-42010a9c0008", "comment": "Malware payload (Efimer)", "timestamp": 1772993093, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772993093, "uuid": "b8b8eb34-4f98-4a54-a443-377049cf3b42", "comment": "Malware payload (Efimer)", "value": "342bc9dc88b6659d8a8c666ad59179b7", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772993093, "uuid": "a84896e7-2c90-4ea7-8e3d-e06164cc116c", "comment": "Malware payload (Efimer)", "value": "cefdab4dfcef12812f54259ab73f38abb8ef948675ed991c06419713dfb5f459", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772993093, "uuid": "396b00dd-99ba-45f1-b42d-f855384ac92b", "comment": "Malware payload (Efimer)", "value": "cfacb683401b72f1399223dcba38cb5d389a2dd8", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772993093, "uuid": "46dcddc9-052a-4e56-8f84-61656fd8e6a6", "comment": "Malware payload (Efimer)", "value": "88c246b24824997bcdde108a888d1d65f2f25d4672accca37db5079a88b3fdcc5a6df082cb021376bdabdbe1a85aabd7", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772993093, "uuid": "d8b1f6b6-9dad-498f-b11f-7ee72e0856c7", "value": "T141D6335859C2A1AEC5E3807C79E12AF9A4F5B86803B09D7E5F5CC3737C6B050CD2986B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772993093, "uuid": "0c10b77c-6170-4b1c-97c8-3bef3dd34d17", "value": "c5e49de42b1165b00bd79240b8cd617d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772993093, "uuid": "31dd7208-1a4c-445a-945d-754013ed3c5e", "value": "393216:ng7DftgmLYJJFXhdpXMCHWUjXNcuI3/PGTAI:ngATdpXMb8X6H/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772993093, "uuid": "50b90ff2-32ce-415b-99eb-8835698cd22a", "value": 12615385, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772993093, "uuid": "bba40060-36a9-4a7d-823e-d7aaf0f303bb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772993093, "uuid": "b7ecf2a4-9a9c-49c2-bc23-6b9275ad07f9", "value": "common.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1b6f544-1b0d-11f1-a769-42010a9c0008", "comment": "Malware payload (CryptOne)", "timestamp": 1772988105, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772988105, "uuid": "5d6ca563-3d0b-4a83-934d-9672c8d36d6c", "comment": "Malware payload (CryptOne)", "value": "236768979a4ef02221fc26f8ddb44cb1", "object_relation": "md5", "Tag": [ { "name": "CryptOne", "colour": "#62260A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772988105, "uuid": "974efada-9230-474d-81de-b63b3dd85268", "comment": "Malware payload (CryptOne)", "value": "d0c819324830a8cb5e94e833b91598dc70aeadf89fb51b252cdf967b8352c9bc", "object_relation": "sha256", "Tag": [ { "name": "CryptOne", "colour": "#62260A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772988105, "uuid": "d5e5a8e6-b489-43c7-bebe-eeac030c5730", "comment": "Malware payload (CryptOne)", "value": "5022d75ac5fdf39d10324575cf289db833cdce37", "object_relation": "sha1", "Tag": [ { "name": "CryptOne", "colour": "#62260A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772988105, "uuid": "33d6fb80-58f4-44d8-a768-91ba196e3719", "comment": "Malware payload (CryptOne)", "value": "bd71eeeec4d61ed10cafe2a893675649afa00dd1cddbd3c8154f9effb7cfab9ecc535da5ab1c856a9253909b2297f92a", "object_relation": "sha3-384", "Tag": [ { "name": "CryptOne", "colour": "#62260A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772988105, "uuid": "70e7a7ab-da5e-4c65-bfa9-26f5f29f42d4", "value": "T17F46F1EE89157933C1A9BAF98C3FD8CA549D6C0E0A138F76329B1CC819457BF0AE5345", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772988105, "uuid": "620a3d4f-6758-4128-94ba-0b2504440952", "value": "e8450cd9fde12fe86ba788a327b66219", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772988105, "uuid": "8a2994f3-a3a3-4a1a-b53b-d619de9d33c9", "value": "98304:jxJmsB+aVxLCmpXLNqp2T2xWtk8pi1IKDhdynPsVtWkm0r/8U:dQsjxLbpXQXZ71IKDOPsVUZ0r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772988105, "uuid": "8547142c-7825-4f14-87a9-8de3efffeecc", "value": 5601280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772988105, "uuid": "556c779f-dc84-4f89-9281-1eca6f0833b5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772988105, "uuid": "a464b56d-8040-405c-a034-c82280b07d1d", "value": "2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e083a73-1abb-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1772952773, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772952773, "uuid": "8e75525d-6099-4bf6-94ec-d9191d18946d", "comment": "Malware payload (Vidar)", "value": "025da70231ec2e9801f131d29bce45fb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772952773, "uuid": "1e232d77-20a5-4e4f-8dbe-9eb51bb03287", "comment": "Malware payload (Vidar)", "value": "d0ca9747e38860366dd54cccd6252d0eee66198ea500a915ca1b0f6f77c727e9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772952773, "uuid": "5467cda4-6d10-4450-aa39-b08846716d40", "comment": "Malware payload (Vidar)", "value": "fb35dd5f51e2206eac41ade0c3aa0e1d3e050fa1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772952773, "uuid": "667db295-3894-416b-ad41-40c482ca958d", "comment": "Malware payload (Vidar)", "value": "63eccec74fc38518256ebc537b778e825b869c9caf0e0539451adb56813043e10e7bc45a3a8747bc768e5fa0447f524a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772952773, "uuid": "ea1f6430-b854-497e-a06c-77082a2e10ab", "value": "T117C619EBE2F48268C35D823BC4628E02D4F773750737C6E7029207549E669CD6D3AA67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772952773, "uuid": "3d4b030c-b682-4d38-b724-a95cf515fde6", "value": "068780fe56d60c9502ffe606f8c04be5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772952773, "uuid": "9e88a0f0-48f0-4f97-8644-7676281d3325", "value": "49152:OX18qps+OYzlmB7ki3LfrrOSVhi04X7FOxHZ8mUFqz5L0TVtoeoMwNdcXCBz+CO4:vzCoeoTPtBOtZLD3pK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772952773, "uuid": "fb232c5d-37f5-4b04-831d-5f1ee1d6d055", "value": 12147200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772952773, "uuid": "13ea8731-be68-4628-974f-84a2963b1cec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772952773, "uuid": "f6c6dfcf-671f-439b-9e46-175ef417e4bc", "value": "1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eda91e2e-1abc-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1772953416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953416, "uuid": "06e975b4-25e4-411e-ac90-1ec002aaea27", "comment": "Malware payload (AgentTesla)", "value": "938acd30a80f6e6907a6492148712b1e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953416, "uuid": "1dae4485-fd96-48ea-90b1-f5182902ebe0", "comment": "Malware payload (AgentTesla)", "value": "d0f64f6a305806a285578cfa33910df07aacac1aa1edd985fc94968fbd96c5cd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953416, "uuid": "1f64f974-7eaa-43e1-9cde-360d9667bad8", "comment": "Malware payload (AgentTesla)", "value": "47de36a10ca5e7885bb7e8201040bfbdfd9b6481", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953416, "uuid": "eb26b95c-0e63-4e79-8840-88ad6a298cfc", "comment": "Malware payload (AgentTesla)", "value": "ebfd4964b10ffde24e9f100693556fa5da6574c78c789811360db220d0ed079c2e3d8ba992d8f8762ac34baf399c2673", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772953416, "uuid": "e0794894-e8c9-4f1a-bacd-e64ced0f62a6", "value": "T10B55BF607FC3676757FC492290F735972B70A453B110A5EFAC34796894326C302EBAAE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772953416, "uuid": "6f1f5ce9-fea2-46fe-9e48-945db758911d", "value": "12288:9J5ZWquwvKYMwqRaQkvl1QwjdvnxC+PxpSf0fNXKYdFKHrTqvfOWXS9CkhBhl1+2:9J5FuxqBxHQN9L6i/kLLvWAcMPIn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772953416, "uuid": "48e16ee5-991e-4215-8b46-960a11c9ec06", "value": 1343608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772953416, "uuid": "62402a47-0b98-4001-95fd-98ab850ce73d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772953416, "uuid": "c8a1da46-0398-4380-9641-6a9770ac8366", "value": "938acd30a80f6e6907a6492148712b1e.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65b4b420-1b0d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772987978, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772987978, "uuid": "8d2cc94c-6cb9-41d4-942d-cf04ccf9be01", "comment": "Malware payload", "value": "843732432aa76f7814547d1745b5cb13", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Giant", "colour": "#D76866", "exportable": true, "hide_tag": false }, { "name": "MalGeneric", "colour": "#1F31D0", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772987978, "uuid": "e54eb589-e787-45f4-9aa6-3077fc8c6c60", "comment": "Malware payload", "value": "d2a282349a21657ff3ef519af65211f632f061049f83554ac6c6bc56f6aa0925", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Giant", "colour": "#D76866", "exportable": true, "hide_tag": false }, { "name": "MalGeneric", "colour": "#1F31D0", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772987978, "uuid": "f498a514-5b51-44e4-a20f-3579739a1614", "comment": "Malware payload", "value": "6f7abf242cb847a3b4b14158aa76d31a92c236c8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Giant", "colour": "#D76866", "exportable": true, "hide_tag": false }, { "name": "MalGeneric", "colour": "#1F31D0", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772987978, "uuid": "7892ab77-64f2-439d-87d5-90314e650a2a", "comment": "Malware payload", "value": "164ee60568b7257ae99108275507949dc5329915440f41bc1692e28a6173c8666a4b6fb08fccc917215ccae59a97920f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Giant", "colour": "#D76866", "exportable": true, "hide_tag": false }, { "name": "MalGeneric", "colour": "#1F31D0", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772987978, "uuid": "49bc1bae-e831-4b90-836d-49b300a652dd", "value": "T1CD87333BF28F623AE56E1A353AB5E210583BB66166520C47EBF8C45CCF124B15D3E742", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772987978, "uuid": "a8a3d390-f4eb-4337-a932-dadf83eda126", "value": "88016fcdef7f227c62171d0afad9aae4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772987978, "uuid": "8afc7641-adeb-48ec-89f2-1a6c3f4bc6a1", "value": "786432:uBvJa4BPk2cq4LobE85aEqygJiItOtclMHc2vGZjmysSAFgOhQPPGHzP:uxJaqs2cq4/HILrc47FTKeHzP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772987978, "uuid": "b9a22510-eaf4-470c-99ab-ee451f79e93b", "value": 38209593, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772987978, "uuid": "044ef3ce-5a85-4633-9bcb-0f47f71e234a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772987978, "uuid": "d89f02ea-a694-487c-8833-8c329ce8e585", "value": "\u8bed\u8a00NFA\u5c0f\u53f7\u673a_\u5b89\u88c5\u5305.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bf1a347-1a96-11f1-a769-42010a9c0008", "comment": "Malware payload (Phorpiex)", "timestamp": 1772936932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772936932, "uuid": "791b9c71-6ced-4b29-aa56-675ae7b2273b", "comment": "Malware payload (Phorpiex)", "value": "ba71ce182c5571808af70af0cc01065d", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772936932, "uuid": "716a4ee0-503c-490d-b2e0-401a1400c5a8", "comment": "Malware payload (Phorpiex)", "value": "d2b94db6cb08e2b659d81e7746d669d09e70ae5d3bd675a011eced94ad66a7e0", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772936932, "uuid": "819f2c75-3904-4ad5-9045-9569f18b9001", "comment": "Malware payload (Phorpiex)", "value": "a6f0a407c2c7fe22e1b1dde85b4c663dec100b61", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772936932, "uuid": "a5b98384-4ded-4d8c-be7c-8b60ba7f157f", "comment": "Malware payload (Phorpiex)", "value": "8b3af591751cd7769b72027e7204bc088f03f1c561b71d9d1b082b7a0626e5908e65b90da4e44caf1413b0e34c1f5b02", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772936932, "uuid": "855f59aa-b27a-46bb-9690-9adf882517c1", "value": "T107823B0FB9834323E19110749A66567BE975A47A33D814DBF7D08AEE06786E1EC3311F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772936932, "uuid": "09f78a01-1ee4-418b-81cc-2e4eacbb828e", "value": "b8b034a37970476c0e8791d5941c31e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772936932, "uuid": "f65abd05-3394-413c-aa7c-439c76e8bb16", "value": "192:PFvSCngTBv0Vwlpqx6qU/Qwz0ile6DZKUSfZzQoWX0zZDj+W1zH/mJxTmv8U9ctQ:RI0Vvt3wz0i0/ZWXUj+MOav8U9cO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772936932, "uuid": "07b5b92c-c8b5-4876-9a22-420affc5b955", "value": 18432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772936932, "uuid": "2597e751-d3f8-4648-a635-7b9bb1b88a35", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772936932, "uuid": "9018de14-50b9-4400-9a9e-ab88e18db531", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a79c9a6-1ac4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772956605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772956605, "uuid": "f3341608-cf28-4ea5-876c-8d166c791af7", "comment": "Malware payload (Mirai)", "value": "6e3301f8ed191bea643451aaa0cb4fbc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772956605, "uuid": "67bd0515-177b-40d6-b113-9adb53ecdbd7", "comment": "Malware payload (Mirai)", "value": "d4aa597fd792aecd88f5cbfe1491efa5d14e5caa86a80eed93d8c4800c6ade16", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772956605, "uuid": "fac822ed-155e-4313-9a7b-6f142cec1364", "comment": "Malware payload (Mirai)", "value": "fff0a69d85a8553e20ab6cc96e682744a1c0940c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772956605, "uuid": "b4c25e75-1790-4244-b928-8766bd14f5f8", "comment": "Malware payload (Mirai)", "value": "30bda0d40f478284e8912f6c0ad451c5050e9b2eefd45afca055db7424b9ec832f0f15b6fde09a895494a3f6f582b141", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772956605, "uuid": "53c35010-ee8d-4465-9aa3-3e5c7c61da08", "value": "T1BBB32A4AF9819B12D5DA22BEFA1E518D336347B8D3EE3202DD149F2437CA96B0E77501", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772956605, "uuid": "5d1a88b1-4d41-44a4-9f06-e8ce9f88a7d9", "value": "3072:RHmNqWGMsBtQ7hHdBLP5EqQaUitsbUpsHLGXwCL/JEf:RssBChHdBP5RQaUitsbUKHjCM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772956605, "uuid": "0509cbe9-4776-4d8e-b066-4c003aa5555e", "value": 108676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772956605, "uuid": "c71872b1-37da-44db-9fb8-f9bbae769712", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772956605, "uuid": "9b6a797c-64df-4455-9817-e88507fd85db", "value": "tul.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3728c6a3-1abe-11f1-a769-42010a9c0008", "comment": "Malware payload (GuLoader)", "timestamp": 1772953969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953969, "uuid": "8fddd883-bf02-4724-9794-66e354816217", "comment": "Malware payload (GuLoader)", "value": "40af9316a7129f926d4aee536bc48138", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953969, "uuid": "007a0d2b-5646-4457-9f63-1c02b1945cdf", "comment": "Malware payload (GuLoader)", "value": "d5a9518f65e537df37484b71362c2390c3f0751ad7f7b1388552d4ae8acaf2a7", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953969, "uuid": "1fb6026c-07ad-40d7-aa3b-5f735f618dca", "comment": "Malware payload (GuLoader)", "value": "5a1a2d0e513f6dee78d04654e37e6926cdd733a1", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953969, "uuid": "82174a06-65ac-4c37-8e31-2614ce2e5e61", "comment": "Malware payload (GuLoader)", "value": "a1a631eb7f87b3c13a9e1869d6b34c1ea59fd0d2d10303a04474eb8936eb08e099adc9d3716e91b0d090e2d40f15a8d3", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772953969, "uuid": "51157b94-4cb0-40a7-b747-86afd1cc7a51", "value": "T1CC735AB0DD2215BB0F43BB48FCE44661C679D315852605B0F5CD8B0D920ADECFBB96AA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772953969, "uuid": "85c56a0b-a11a-4ab0-a231-99d1a7eb5c7a", "value": "1536:1zjgpCXE+eAWYCwaQha0YhixhupJUBOIrB24Sxr+NUEX+fAOC8:1zjgpS7Cwa90YUxhyJzIPSxr+NUEX+oc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772953969, "uuid": "9a60bb9f-ad07-4d58-b174-ef46e20b41ab", "value": 79300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772953969, "uuid": "96849ddb-3c79-44c8-8549-bc53c4d3cc62", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772953969, "uuid": "b024b1fc-31f5-4631-aeb5-63d38bb37687", "value": "40af9316a7129f926d4aee536bc48138.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f052d553-1b29-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773000236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773000236, "uuid": "e1778ea9-00f7-4a37-bb0e-95e13be83048", "comment": "Malware payload (Mirai)", "value": "b439eaf249593a04033db32b91933455", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773000236, "uuid": "75bf70e4-1298-481a-9fd9-c4ed9308a637", "comment": "Malware payload (Mirai)", "value": "d7793f8f354b647dd2ce4c2f33f06a8cef9fdd66cd64f52590c094c12d6ec521", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773000236, "uuid": "a83b7295-8d21-43d5-b23b-01e482154591", "comment": "Malware payload (Mirai)", "value": "a6bdface10eea4e5b5d2d7535480adc46b89507a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773000236, "uuid": "f63e7839-21da-41b1-8501-643fa836e9f9", "comment": "Malware payload (Mirai)", "value": "cd8d3ba0ab9caa2884725c64123bd7730f98bb81fc141e8c6279d1bf710754da00a29271b375fa64cb916ba3629f10a9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773000236, "uuid": "52746446-9b61-4470-a70d-b6afd286b796", "value": "T19BA3F586BB43CFB3D44314F012B7AF324A32FC7A192AD682E379BDE159511C1A61672C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773000236, "uuid": "4fdeeac0-2f8e-4fde-899f-cd81ebe1f393", "value": "1536:GxJMQhtJdiylpY0O9I1lndtr99qBUWemavS4SsabOyRY:cJMQhtJdiU3+I1ldH9qWvpKOabOy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773000236, "uuid": "ea2c8fd3-7aff-49a2-9993-991573096e45", "value": 98892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773000236, "uuid": "b56157c9-3229-4c63-80bf-237a73f83068", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773000236, "uuid": "edb6bf8e-84ab-4d93-a632-d4c4cc840e28", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50ba6729-1b11-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772989660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772989660, "uuid": "50fcd499-4513-49ab-bac8-37db445fca3d", "comment": "Malware payload (Mirai)", "value": "0f11b34d2847603830a9bf5d33b66da7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772989660, "uuid": "f754c109-0b55-4237-9eb7-e68580576ee3", "comment": "Malware payload (Mirai)", "value": "d82c58c366cf3eb2d2e8b78c999853fe39ba4d6b83a2d715c71cf8ee7a7845b0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772989660, "uuid": "5a6fcc3f-a577-4a0f-a4cb-198dcfef8ade", "comment": "Malware payload (Mirai)", "value": "bc11771c59ebf8ddcc15784b2b7e11b06c76c0dd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772989660, "uuid": "446808a5-48f6-45af-a173-df106337e0eb", "comment": "Malware payload (Mirai)", "value": "e62c1b411795de44d0b109def17e938758e3e6345c0ebd80c54116c0d4a463c0bd9d31cfb7fb45aadff3c7b070592a64", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772989660, "uuid": "0ad8f28e-b836-4f53-80ac-5dcf6027472a", "value": "T12D45338E3E1A729D4C05589BA7E85822ECC9D0C535BCD42FC4CBC4E1BBAEB52D560CB5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772989660, "uuid": "d5c92100-e8c4-488e-b634-c1df97c37526", "value": "24576:rQOEf6hP95dfuWM40HDIQN1c66utnu7ZGWZP9f:EOvbJiHDR2utu7ZlRZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772989660, "uuid": "856c01f2-0064-4729-a2dc-0bd794a83fe4", "value": 1208556, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772989660, "uuid": "7f95341d-1058-4049-a5d5-9302c63c1c48", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772989660, "uuid": "db0afd6d-9f7b-4d4f-9cd2-ac93f8fb6bd8", "value": "armv7r-linux-musleabihf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc17048a-1a92-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1772935402, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772935402, "uuid": "f9052699-e950-40a5-9591-87639b8bf708", "comment": "Malware payload (SalatStealer)", "value": "eb99a50a1eb51e262e2cdcc2f9a8f3b9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772935402, "uuid": "357817b2-55d3-433a-adde-834451b517f9", "comment": "Malware payload (SalatStealer)", "value": "da82df14a5412247654f68667f65d00e537f22d2d742ec39f6e0dce3831e44dc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772935402, "uuid": "45179f33-1f78-4fe4-8a4a-0c4d4a728d6a", "comment": "Malware payload (SalatStealer)", "value": "a879f9f0b775bf3f2786146e2e94e657626b18d5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772935402, "uuid": "441d4a2c-b8e7-42b0-8ddc-c4b2ab1baa21", "comment": "Malware payload (SalatStealer)", "value": "536e865fd2537e6f1695a6bcce5ae1456e75310a7b07391297cc77221efcb8013efad1046db48886e36ba66bb56a97d0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772935402, "uuid": "75ee3796-bfdb-4833-9f91-3f93028d6900", "value": "T129C65B01FA8B98F5E9031835816BB23F63315D049B28DBDBFB547F6AFC7B6811926205", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772935402, "uuid": "ed5ac617-4db4-472c-87d0-b3bbd0b625ab", "value": "4f2f006e2ecf7172ad368f8289dc96c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772935402, "uuid": "6d993a32-aa0b-468d-8590-204bdcdf4cc8", "value": "49152:VnAiTSCjvkHQVehfwJL0izh1J0Rh6FDHdCC+v/Npt7N7aLGEFO5DLE5dt/8mHH8S:1BTSCvVB5mNpvaLudst//7Dp69By", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772935402, "uuid": "51862435-e480-492f-92eb-dcb7322a62eb", "value": 11673088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772935402, "uuid": "7ad20018-ea35-4ac7-8f22-4f3d969cd095", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772935402, "uuid": "a93bfecb-7745-454a-9701-c3b39ab6135e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d8be892-1b11-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772989655, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772989655, "uuid": "b97ef04b-2d83-4966-a0fa-15f5eb58b3e1", "comment": "Malware payload (Mirai)", "value": "54dae6bbf6254d335b8412f484a6564e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772989655, "uuid": "cf3e2b43-8265-4b60-870f-a76e91ab8c92", "comment": "Malware payload (Mirai)", "value": "db05a33b1a5bcafa971154bc0c8c1ab94b71cbe86d11a3898536cba4ea13a9e1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772989655, "uuid": "45134f8a-d135-480b-8a1b-8e4850a88da5", "comment": "Malware payload (Mirai)", "value": "1fb141e5391ce9eea9cd014b049199f064b0e5a6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772989655, "uuid": "0646acd6-6df2-46e3-b241-ec0115dfd6fb", "comment": "Malware payload (Mirai)", "value": "d47d17c1bb5157195c15c3e7c2fe36e6b3f6f071628d0c59799e0966c736e0da1253084c4bba75268b957397b429f3c7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772989655, "uuid": "d78f496a-e3d4-4a15-a4d1-f9ce0e0c0e2e", "value": "T1C545334A1C65B68D9C42265BF3F858224D46C850307CD56EC505D992FBBEFA2FAB0CF2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772989655, "uuid": "a72f6c74-5201-46ad-a09d-269aa4e59227", "value": "24576:WQOEf6hP95dfuWM40HDIQN1c66utnumBkZyC1H8UCIx3P:NOvbJiHDR2utuFy0/pf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772989655, "uuid": "c5b024dd-d6b9-4018-9a87-57b72f4147b2", "value": 1208596, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772989655, "uuid": "89e5967d-0426-447e-bd8f-bd1744dfed79", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772989655, "uuid": "3982935d-f5cf-4ccc-869b-beb3c07832ad", "value": "armv5l-linux-musleabihf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fceb1d70-1aba-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1772952583, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772952583, "uuid": "792257cb-d53f-4509-9356-dbe6e25b30f9", "comment": "Malware payload (Vidar)", "value": "fc38c95c375adf2d9c2a72d2a64f7e12", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772952583, "uuid": "2ea5704a-686a-4537-9945-a6e7718c570d", "comment": "Malware payload (Vidar)", "value": "dc92808757801d73cdf339c1ec0a18cf8ea2ecae7f889b0b4970685c1bc249c3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772952583, "uuid": "16f6515e-76c6-49d4-ba0d-5fc83f161f09", "comment": "Malware payload (Vidar)", "value": "05421f58a6463b28458edece186f4d44027c95ef", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772952583, "uuid": "d902b3fd-6a33-409b-bda6-eccc944a27de", "comment": "Malware payload (Vidar)", "value": "1a3c9835aa11d97bd1b3150c94ddb9c14ff029758d45d32f13a9136b8dafd57dd060e6d2f83dcddd5cee457ca09b8fb6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772952583, "uuid": "99678b56-a975-4de3-b2f3-7449cd9d248d", "value": "T12E66E52B3E648168C10D813AC4628F31A9F37DB5473783D7169273688BF6DC59EBA634", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772952583, "uuid": "afcecd7e-f782-4199-ad56-0711be69ba02", "value": "936eec5968f81c23f5203e74ed229fe4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772952583, "uuid": "da389152-8fea-44ab-86b6-96b0808045e8", "value": "49152:wCvod9EQKqv9II9DtxGFYotTbMQ1lSZFbS6L3UTOiX3e+fAUxSo+tr+e7R:BvEw4FUTOK3ZfpB0l9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772952583, "uuid": "a855fd44-d119-4adf-bff6-d5304f92b486", "value": 6662656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772952583, "uuid": "6de831e9-c3dd-49f3-b748-fd9c134febfa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772952583, "uuid": "8676d1c9-fa0b-4599-9d28-146189a4af2c", "value": "fc38c95c375adf2d9c2a72d2a64f7e12.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "718dc907-1b24-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772997876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772997876, "uuid": "878bc759-03f9-4d39-9f23-83bfecd7e56b", "comment": "Malware payload (Mirai)", "value": "4e06b5d1de35ba10a7e1210c446383bd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772997876, "uuid": "3553857c-371a-47a9-9f95-da4a6440466c", "comment": "Malware payload (Mirai)", "value": "dcb445475f9c1f904eef13fb0f30d82b8d9c6af3a10659af2240d73dd9f26e92", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772997876, "uuid": "2ea7cfa3-590f-474a-a909-a97b2864c068", "comment": "Malware payload (Mirai)", "value": "56f061ecc59ed70ff575526599b82128b72f6fa4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772997876, "uuid": "e57400ad-9d5e-4b2f-9518-c253d02a3848", "comment": "Malware payload (Mirai)", "value": "67f5bcbd40ce347a965f2ff3a75f6418df82404fc527b4e40e00e4900539a2b8ef966c51190c643e0bf5d7dd0f556a6c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772997876, "uuid": "f3cce44c-4d34-47a5-bc7c-5e4f63f8e8d2", "value": "T16D13F1B797437CAAE82336B671026780DE785412AA475B3F046172EECD78A973F244F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772997876, "uuid": "42a431b1-7072-4713-8dec-4b9880e043c4", "value": "768:hd6Rhju90wsPHrbfNfGbhdVDFGXmmdArRQxFMqPmvhkz3UcNY0TGa/pNGa+EZx0c:hdSw3sPPov8X3amFTmvhGXtLJ+gjx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772997876, "uuid": "5c402e84-20d7-4999-a5d6-5916c7516578", "value": 44540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772997876, "uuid": "1d747ede-0045-4b76-845e-1f8c2c9cfe22", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772997876, "uuid": "0ca794b6-bdba-4775-b06c-e0fdfa1949f3", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a6b0d70-1b13-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772990509, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772990509, "uuid": "a921cc1b-e122-44bf-9b7b-5914d7d0b625", "comment": "Malware payload", "value": "555d9aa4333cbe5a15a1528fdff8dbd1", "object_relation": "md5", "Tag": [ { "name": "144-172-105-241", "colour": "#C656BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772990509, "uuid": "a4eaf818-b0ec-40fd-ad73-8c1c6a955eee", "comment": "Malware payload", "value": "dd3579801cd58a999a6223ef687e9e0276c79ba6c3bd3d948d934c02e2cae2c1", "object_relation": "sha256", "Tag": [ { "name": "144-172-105-241", "colour": "#C656BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772990509, "uuid": "fe4343dd-976b-41db-a378-8ebcff190099", "comment": "Malware payload", "value": "480cec2b7482f1cb48aaaaaaf16e8d8c31fe9735", "object_relation": "sha1", "Tag": [ { "name": "144-172-105-241", "colour": "#C656BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772990509, "uuid": "72cf5df9-0e9b-4d5c-809e-efd4d141895e", "comment": "Malware payload", "value": "f04cd53c9df284e5b081542fee4c480847a1b339553872155ed5bd96294bcf3afe24b942089a4f12eb9fdafd8511bf07", "object_relation": "sha3-384", "Tag": [ { "name": "144-172-105-241", "colour": "#C656BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772990509, "uuid": "fde046b5-64ea-4e32-805b-e735637b9396", "value": "T1D5F7BE6D13BCEFE4F039BCCE409E2C9109982305A67A6233D25CEA55D3D875E0E768D6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772990509, "uuid": "974e7786-a111-43e7-b263-d26fd29318c3", "value": "785581baab0911f04d2f4ae759b57715", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772990509, "uuid": "5f972042-8cb8-4a01-8943-e621b7cf65ff", "value": "1572864:+r+IY7nDAWyY+DhXuC+CR3kWPrjfy9UDOgi0FYg9Sz+Oc3PGRZojf:Y+p7nDgNFF+CRhFYgDOqORZu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772990509, "uuid": "5074b438-01cb-46e1-823a-3cd3b3deb9f7", "value": 74699264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772990509, "uuid": "db1dcddb-6d83-444a-9b7c-215e40459915", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772990509, "uuid": "5df29f41-bf10-405f-9e0b-01c1cef89972", "value": "notafiscal132421323344432026.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8d1c691-1b2d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773001968, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773001968, "uuid": "21aea9c9-0ac7-4e66-990f-97af14116c13", "comment": "Malware payload (Mirai)", "value": "71366deea548cf345c8cc1db06eb3774", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773001968, "uuid": "9303effa-aa5c-4897-8b42-a569e494c2b2", "comment": "Malware payload (Mirai)", "value": "dd8773feb7d08b06c3c55dd5c2da7bdadfba6578f5b3d65b7e0d0577f7db7af0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773001968, "uuid": "4dc25d5e-d5e7-46b2-afd7-540e86b45cf4", "comment": "Malware payload (Mirai)", "value": "64b10252179943722623ad1f95644cf5da34b9bf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773001968, "uuid": "c759bb34-fc1d-4ecb-8ce0-58cd4e5eacdc", "comment": "Malware payload (Mirai)", "value": "6a88892fbf30ffa354d98ae1496200e135fa7eac323024d84d043f29c1d7f48ba0bea4395d0313d4a1ae19915c2c304f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773001968, "uuid": "422e6ccc-5075-4ddc-81fb-ee4ceab96824", "value": "T1D0B32B05AF620EF7D86FCD3742AD0B4634DC5A4613A97B3A7674C928F44A58B0AD3C74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773001968, "uuid": "ce33ad47-7bbd-4a7b-9f2a-3d611585afd4", "value": "1536:KLsIcfTuP6mYme7fcSBsF3YI/pXUZ/ZZC04nkNihKS3iZ2/Pz/GWe7hfFk:KAXfTrpme7tGpX0/7NiLFH8fe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773001968, "uuid": "38ab974e-ff2f-4e87-ac3a-a5c4d2e803b9", "value": 117652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773001968, "uuid": "11d029b7-8b09-4e8c-9029-c02c858a82ff", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773001968, "uuid": "03d45eb1-e1a3-4e06-9f5d-861dfc2ff558", "value": "violetmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c1044fb-1b0d-11f1-a769-42010a9c0008", "comment": "Malware payload (CryptOne)", "timestamp": 1772988069, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772988069, "uuid": "5cb884d2-e60b-488c-a012-75c6a5abd4a7", "comment": "Malware payload (CryptOne)", "value": "a793df87ecd5cc01d6e520b50aaef895", "object_relation": "md5", "Tag": [ { "name": "CryptOne", "colour": "#62260A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772988069, "uuid": "1cd20adb-5330-4559-8188-ffc1b518c7ac", "comment": "Malware payload (CryptOne)", "value": "dda046b4c05f28e0a4cbce0c109b1683fc43d2716b1b7c74f651880ae4d699ef", "object_relation": "sha256", "Tag": [ { "name": "CryptOne", "colour": "#62260A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772988069, "uuid": "8acb1e42-4830-434b-9303-b9c0e0d05d1a", "comment": "Malware payload (CryptOne)", "value": "19411ba4366cd4993fa746b7af29131e5ec1ed00", "object_relation": "sha1", "Tag": [ { "name": "CryptOne", "colour": "#62260A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772988069, "uuid": "2f6c4371-99ce-4286-98eb-1f1cb97c75f5", "comment": "Malware payload (CryptOne)", "value": "89820170cdb878c1f282dd101f504b96c6f7d6fb48ba6b4d7a1cbec254f77cbcf27a069965a7b8147b97f0c8aa8ac4f8", "object_relation": "sha3-384", "Tag": [ { "name": "CryptOne", "colour": "#62260A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772988069, "uuid": "349190c1-4dfb-412f-bcab-b55d461c8527", "value": "T1B236F166CAD6C43AC42224F3ECC7BAA99E6AEE1078D5F45613D40CD7C9D42FD69800BD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772988069, "uuid": "ea112dd4-fd8d-440a-889a-53a3a4c2a4fa", "value": "e8450cd9fde12fe86ba788a327b66219", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772988069, "uuid": "448f6352-b22a-4dcb-98e6-082d1a6ba25e", "value": "98304:rxJXbqqYEKQgCkDAeDSqRizanRIb7w5QDkgD:l4lDbSqRiGig5Pg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772988069, "uuid": "df79da52-e787-40a7-963b-4fcd3794891f", "value": 4998144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772988069, "uuid": "b67b40b4-1bf0-4373-8f94-65b20b5d0365", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772988069, "uuid": "4aacdbb5-8525-447b-8093-1e822e7c059a", "value": "a793df87ecd5cc01d6e520b50aaef895.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31346381-1b2a-11f1-a769-42010a9c0008", "comment": "Malware payload (MaskGramStealer)", "timestamp": 1773000345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773000345, "uuid": "ec045434-1983-4577-a3f6-abff89479e7a", "comment": "Malware payload (MaskGramStealer)", "value": "61efbb1826dc6ae4503bfd37baa51d34", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773000345, "uuid": "119169c3-7efc-4de6-8a53-84f834da4d0e", "comment": "Malware payload (MaskGramStealer)", "value": "de18bb269601d0a009d23cd252967880b9b95e1f02e7fcdc7e7e4832221871f5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773000345, "uuid": "a53b5b56-03f4-4397-b5b7-ca59ec9761f4", "comment": "Malware payload (MaskGramStealer)", "value": "eb3337ddf342d5d1b3b2150eaddc85ee5d613d76", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773000345, "uuid": "91201211-5ac2-48d4-ae1a-8b04fb2fc240", "comment": "Malware payload (MaskGramStealer)", "value": "8aca00ff889d71b660a2713aaaa592f2941c289e2dbf096d06dfd59c292d4117f3ab3dd98a5e0f1f23025213722cf833", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773000345, "uuid": "19c4a5ec-f4f6-4c54-80de-cda59be8632a", "value": "T16594C0DBA9F064D0CC4922F65C212AEBBB3715738714415E136AEB660F27BF84D2DB12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773000345, "uuid": "3b519cc3-2552-4527-8cb9-fe2ae7e63ba2", "value": "df22469fbcbcfbfc3b5d4e0f752d717a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773000345, "uuid": "b36a7ed2-56e5-49f7-bff8-e8ed062b818b", "value": "6144:OEixfXNfou3vXFCkp2/5G5UlttKRRFmwTjO03y/hK2I/ol:OE6NfouAkkxGUAR9fO04KN/ol", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773000345, "uuid": "1d7ba7ec-4eef-49af-9b0a-47f96e8de2ae", "value": 435712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773000345, "uuid": "b757fd02-40ea-4f23-86cf-4608f6929fb0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773000345, "uuid": "77c6d4d4-1c1c-4f69-a4e3-ec6188ac86ec", "value": "update.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27371511-1abe-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1772953942, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953942, "uuid": "ab95f269-cac5-49a7-a9e6-eb47d5d0f741", "comment": "Malware payload (AgentTesla)", "value": "56af96a85dfaf6653da4d5e8c010b188", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953942, "uuid": "65c51c54-4205-486c-abbf-292fe1a04f25", "comment": "Malware payload (AgentTesla)", "value": "de32151ad51e2a245349949476dd6c2c8f8c8f2221f0526a67062165e05dfde7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953942, "uuid": "7c640fe3-68f3-4df7-9643-3cc7dd1d131c", "comment": "Malware payload (AgentTesla)", "value": "2676af249d3a0c12d76ac8d3ade4d8571f38935b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953942, "uuid": "4c20977a-6993-46fe-a942-f8b5eb937c1c", "comment": "Malware payload (AgentTesla)", "value": "2319ab517fc5f38979432e793718ab02dd4bc4014086c795669cb50ef132c949596348c56b9349c0cfc817db219082bc", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772953942, "uuid": "2816a468-2a13-4249-9b5a-682f7ee3ff0f", "value": "T152658D030994EFE45DCCB91B74FF721C17E039AB94DEB13AA630EA1BA6711A514223F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772953942, "uuid": "5ebc871c-93a6-4062-860e-f3e074a06e7f", "value": "12288:/xbHsM2LF8kF/bES5zydUTtMa7rKat9jDWsMgHxCZhLOSeKVF4JXvo08illiCJMp:/xbpQmk97D9WNHeguep", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772953942, "uuid": "8ab18617-10d8-491d-8e3e-872d059b26ec", "value": 1459760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772953942, "uuid": "5be7a29a-de59-4e78-804a-92c1e2bd5bdb", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772953942, "uuid": "b780f90d-ac52-4ed1-b8ff-9b831f2ea5c9", "value": "56af96a85dfaf6653da4d5e8c010b188.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4d18fe2-1abc-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1772953428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953428, "uuid": "dc86c52a-e74b-4436-b2e1-b6173123c322", "comment": "Malware payload (XWorm)", "value": "012e798a4e97f363c031e00fb4079d0f", "object_relation": "md5", "Tag": [ { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953428, "uuid": "c8c76240-d05f-46fd-9947-a20ff4bb305d", "comment": "Malware payload (XWorm)", "value": "de833013d8f165149d7c25e3cdf66085a02d856bb025b2e34f4435d9dc10f9f5", "object_relation": "sha256", "Tag": [ { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953428, "uuid": "9af1b391-ec1d-40ed-831e-c1cbb534b8d6", "comment": "Malware payload (XWorm)", "value": "ce226c35481f153201f85202874770034fd086c9", "object_relation": "sha1", "Tag": [ { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953428, "uuid": "088e08cc-cf6d-4c15-9954-c6fb346b3bf3", "comment": "Malware payload (XWorm)", "value": "55fb822fbfafa757c9bd6123da656288a9c9701a0420fa2b55df8bc0fb83a953bccfe721158ea9e90ec3de600da04d09", "object_relation": "sha3-384", "Tag": [ { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772953428, "uuid": "6c1b8f56-c1b3-433d-b237-1788c4fdf837", "value": "T18615A390B5D74CA10F52D486BDA1268ABC98CEF3703BF6FEB57474E6D062DA910412F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772953428, "uuid": "c94e8bf2-2a4c-41e6-85eb-0d73d0979bc3", "value": "96:tttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttc:rt2I0rB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772953428, "uuid": "f7ed50f7-d0e2-4888-8761-3b483e9fccdb", "value": 919853, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772953428, "uuid": "10c6af44-c64e-4928-92e8-d58883ce236b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772953428, "uuid": "a7476bd9-080e-441d-be21-72c22c7925ed", "value": "012e798a4e97f363c031e00fb4079d0f.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e4c53f0-1abd-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772953552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953552, "uuid": "73651b5e-301e-4a22-b3ec-0d419495ae15", "comment": "Malware payload", "value": "23f9525390eafda913cde16b23d818c2", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953552, "uuid": "7af4bd3c-0c2a-4eb5-b280-417e2394142b", "comment": "Malware payload", "value": "dfca80c9c059b38f065e79aef89b79e3ad333804c2694e249f9fa690470b110a", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953552, "uuid": "41b21351-f6d9-45d4-9efb-efea1b63fd42", "comment": "Malware payload", "value": "864c9ba30a6669e41f30e96d83e82748d5fd0eb7", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953552, "uuid": "9d160b7c-9397-4462-90c2-dd064b6f1fbb", "comment": "Malware payload", "value": "502b01a38aa7bbe0bf43a1a9fd3ce485e3211e77fab3ef7c9e5cb9c54d329e2665ad8900a019b1767982056ebd87cd75", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772953552, "uuid": "bd691af4-c816-4cf0-be56-982473da45bb", "value": "T1A6551B676F28C9D90B3236A7FD516D07EDF19A6E02B52E27311ED012205ED6D32BAC13", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772953552, "uuid": "5142f040-3571-4e72-8f44-b4c4797bcdfe", "value": "192:LuyoD8UDgyGxOW/wCgnlXTaLaXBZGlLgUxtaxSniO8Y0Z0lfmq7qO4eP+O+cdyUU:WUEXj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772953552, "uuid": "37554c6f-05ff-427c-8f60-84a1c739bd8e", "value": 1312476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772953552, "uuid": "5a78e241-9641-4923-9a3f-94e2b6767711", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772953552, "uuid": "f2105e1b-5121-4a3e-b036-3da9cb47fcb0", "value": "23f9525390eafda913cde16b23d818c2.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f150f49-1abf-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772954385, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772954385, "uuid": "aa27fe07-b603-426d-8e88-cc81e1c1daca", "comment": "Malware payload (Mirai)", "value": "dd30bf096c337e47e256d3f7f788d42f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772954385, "uuid": "301d500e-735c-4168-9ee3-126ebc54890c", "comment": "Malware payload (Mirai)", "value": "e14a3f2ffb3bab0d5358536f09b90d39899718ee9f24799f4e240b312c8ca33a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772954385, "uuid": "2b2909d2-4b62-4401-b573-b7e86c4523d5", "comment": "Malware payload (Mirai)", "value": "b133c2751fea094d773f2733a3203115e0dfb4b8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772954385, "uuid": "c3fcf24d-cedd-401a-82b7-c37a5dc48ad5", "comment": "Malware payload (Mirai)", "value": "e779a513bf34520df336dda88b5fb2b7eb701d287bb569094284166dc2e7d2e35639c609a42b80b9ff2cafb882da99a0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772954385, "uuid": "514ef497-cb49-4c0c-bcbb-cbacd0ea97d4", "value": "T1C6C3AE73D42A7EC4D1514034B8B5FEB51B61A5C041935EBB26E9C87A00CBEA4FA0AFF5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772954385, "uuid": "dd41d794-418e-47c3-9e2c-abdb301e853a", "value": "3072:hfpZykqkt436I+9eIHimNOkSMPXeC4GnHW:hRZ0F3Bc1NOkvZhnHW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772954385, "uuid": "8410bb77-a338-4b5a-842d-65f7fe62bbe0", "value": 120332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772954385, "uuid": "3666de85-de12-4a43-b0e9-ebf3c9cb8a30", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772954385, "uuid": "5f106958-1351-4fde-9107-1c4eb5105241", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71a3408e-1b11-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772989716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772989716, "uuid": "5406fe70-a109-4600-990c-bd6646dcd813", "comment": "Malware payload (Mirai)", "value": "baf1a5eab9881abdcbb6f15dba3ee4a5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772989716, "uuid": "a98e2a5d-9615-4a6e-af1f-d8021e90388e", "comment": "Malware payload (Mirai)", "value": "e1586449b0cd23ff53220921d23625d627c75e89a1630267e4ed47d0c1694b15", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772989716, "uuid": "66076a88-3bf8-4639-8c51-499bb802d64b", "comment": "Malware payload (Mirai)", "value": "6a7e8ec9bda3692e2631b603fbbccdc240c0e907", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772989716, "uuid": "3470df84-4d8e-4343-b52b-1d179082bf2d", "comment": "Malware payload (Mirai)", "value": "2b0cfdc5a86e1a6ffe4f8795f5b64941ef211ceef04626494854418b4e918aa474782d2fda5e50a3cf51992b35db927d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772989716, "uuid": "c381bafe-936b-409c-9b72-3b3ae638fe1c", "value": "T1B14533EEC1742FA444EC4C389D2945EC572AB55D96D281D4D8E6AFCA2C8BC3D13A8F07", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772989716, "uuid": "dd2fb07d-79ae-4143-85c2-74b0fe88b656", "value": "24576:miVp/UcJIQWQLucvxzC6SGw2z5CWzY+CbTKUWVxIII796iybQLBDbzdX6:mi/5ZvSGw2zY+CKNgI9iGa3zdq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772989716, "uuid": "1a546a69-ca84-45e8-8813-976b889e9ee9", "value": 1205368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772989716, "uuid": "6de4e5d9-524a-4333-b021-0e9cb3c208b2", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772989716, "uuid": "7a873f58-669a-44fb-89f4-de80dead3ea9", "value": "arm-linux-musleabi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c9dcab2-1b11-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772989707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772989707, "uuid": "36e8ebc3-499c-43ff-bbc9-25bfc05d85f1", "comment": "Malware payload (Mirai)", "value": "0b0c336a5b6332418ed0e690d79fa584", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772989707, "uuid": "b54d8e27-a416-4b1e-8938-bc917b323417", "comment": "Malware payload (Mirai)", "value": "e18cf490ea83097046528d9cbed1c68c64a33d61910aaefb7241f1bc66c33dcd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772989707, "uuid": "1c9828a7-c2aa-4520-a0e9-7fb79624ba23", "comment": "Malware payload (Mirai)", "value": "511a69bc508f1491a2427b87209972d773df63f4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772989707, "uuid": "8d0fe86a-2a12-45ee-bc34-f2b11caf0a0c", "comment": "Malware payload (Mirai)", "value": "b6c4a4583c3496a9b2822e76c45936e9a3aa7274f016c8491fb215eb50bc305eabe44bfd7e3288c8b6c8c830208b3392", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772989707, "uuid": "654b0043-daa5-4aab-be19-aba11fa95ed1", "value": "T1F3F55A62F891DE93C6C0567ABE5EC2D877131774D2EF32028C0547283BBB96B0A7B552", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772989707, "uuid": "11381e1d-a5b7-4c84-aeb7-b1d3bd91bf1c", "value": "49152:BU4WFAOW/vQFB7wEHUC2aX+w/Dr+5fWCQPA:w3MvQZz7+ccWCV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772989707, "uuid": "a7da3610-f018-4f36-b662-139744833537", "value": 3549544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772989707, "uuid": "d993e8c1-941a-4711-8751-7b395bb53999", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772989707, "uuid": "e516603f-52c0-4d23-b0c0-4ceecd651037", "value": "armv6-linux-musleabihf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "564ba64d-1b2d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773001696, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773001696, "uuid": "dd3ab366-a3d9-49e2-95b1-2176e3f92ae1", "comment": "Malware payload (Mirai)", "value": "cd18ea672fb0b34602b16bf1f469086e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773001696, "uuid": "70adf52d-6be4-45bf-b898-8523e89b51f5", "comment": "Malware payload (Mirai)", "value": "e205498f16b3ba4e34f18f93e11a526699ab28d335ce616bf513e24cbc476f92", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773001696, "uuid": "ba76caa0-7e5d-4ca3-b46e-666b06fffb0f", "comment": "Malware payload (Mirai)", "value": "c75f2d1f1f47208978dd0bd3350db79f9997f973", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773001696, "uuid": "e1d50376-0cbe-4df4-b482-b8241e6fcaaa", "comment": "Malware payload (Mirai)", "value": "0c358bc8e6aaa2556f197b5878c4a4d936e536c7cae40ca8b8d63cd5b079e579be8fa5b11c7371a6948e929de4926572", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773001696, "uuid": "1e5da7c1-6a0d-4dfb-8202-64d3d43c01c4", "value": "T1AEA31996F9818B22C5D512BEFA1E118D331317B8E3DE72129E205F2077C696B0E7BD46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773001696, "uuid": "13c59571-9903-4058-9aee-d4d9b033e677", "value": "1536:5Dn+pXv/DnXflNe8mZhvI6dBpQLVajay9VacAeQjaMS5ipo2nu0x71R59YYPYs:SXvjXLe82yVajay9AQ+o2nu0xxRjJPY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773001696, "uuid": "59094bae-f8f0-4185-971e-c9d584ae0311", "value": 100868, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773001696, "uuid": "871aaf3f-fb3d-41e2-8aa7-aa4ba88db76b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773001696, "uuid": "2dd74026-1f5f-45e0-93e4-2514433102e3", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "149bd069-1b15-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772991277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772991277, "uuid": "476f0806-73c2-41ce-a6df-b44a19f3494a", "comment": "Malware payload (Mirai)", "value": "93e28ccb4fcc457b69f3665725e45781", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772991277, "uuid": "fc9f3ecc-80d2-48d0-9910-a9597a427fa4", "comment": "Malware payload (Mirai)", "value": "e44cbcfb676e440ce902f502a2d24786e022ee77a8a994dc6d9a5b176d0d3b25", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772991277, "uuid": "63496f61-9ece-43bd-88b2-dbd2594e8c24", "comment": "Malware payload (Mirai)", "value": "d6b5298646cf7345b02f8df2745b7b6f98576751", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772991277, "uuid": "069a7457-6cbc-4164-b4ae-efc6025fd052", "comment": "Malware payload (Mirai)", "value": "a94ce763ea41c4379abf675623ad81ea93d0fa96fed6e2afb99e0d6ca9d8bcefc68960b4a2071a327e023e01447aef8e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772991277, "uuid": "9bf66293-b77d-41ae-93c9-7e1e353873dd", "value": "T1CFE30B46F8414B12D5D111BAFE1E528E37131BB8E2DF73029D246F647B8A97B0E3B905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772991277, "uuid": "6ce2155a-8c49-471a-891b-ae1ba04c2120", "value": "3072:DHea4CTSUjnwJIXMb6kzz5aTHACdYV8P4eLK:zePCTSQ6IXu7zdaM38P4eLK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772991277, "uuid": "228f4606-2362-446d-b8f4-9ac3e8980d7c", "value": 144156, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772991277, "uuid": "870e2a9d-d9c3-4fb6-9dc4-ef9535dfe72b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772991277, "uuid": "ca338664-ba17-4774-92b2-dba933d3d756", "value": "main_arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75bc3900-1b32-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773003896, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773003896, "uuid": "ab4fa39c-b171-424f-a4ab-1c3749274c05", "comment": "Malware payload (Mirai)", "value": "24c7a397857cda55bea9ac17baedb6a3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773003896, "uuid": "dde16b31-6122-4435-8c2e-7b472f877ba3", "comment": "Malware payload (Mirai)", "value": "e62395467b7ddb1f2fd060752aeacd12f383ebbffd8b5c8fb21fa519a8921492", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773003896, "uuid": "e34929cc-dcdc-4e7e-9ca8-e3f285befd7b", "comment": "Malware payload (Mirai)", "value": "1634144f806eb1e6f37b57d454127333d0b2377c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773003896, "uuid": "2804cb3d-eab0-41a5-9bfe-73c1467d33e5", "comment": "Malware payload (Mirai)", "value": "1fc07b628b07b1539a200f5478b05f0d86d54fd0bab4d56a35ac1086c6d9841b8465b107359d6c851a38b5a95c1d3cda", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773003896, "uuid": "fe022e3e-9b16-49a8-921d-f2e001fda225", "value": "T10744F7077B517EB7C8DBDE3306F6C60124CEF4532664672A72B4DA6CB90A58F0993CA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773003896, "uuid": "b59fd0f9-0b19-4a9d-a453-623609622d13", "value": "6144:n/eVFeSowSy1KxrkQGy/+m35gZNxPeHy2O/6lWI1:n/e2SfSpku+m35gZNxmHy2O/6lWI1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773003896, "uuid": "bf330bce-c129-4888-ac73-9eea3bd63a65", "value": 262750, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773003896, "uuid": "938e718e-6301-44be-b623-8a94dce17dad", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773003896, "uuid": "264f1af0-f831-411c-95b0-f3d3441319f5", "value": "m-p.s-l.dick", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b8b74d5-1a8d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772933092, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772933092, "uuid": "fadcd027-5c08-468c-ba1e-072e3405814d", "comment": "Malware payload", "value": "29bc0bd71fbfdf51a2abbbaf95842872", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772933092, "uuid": "736dbdbb-3321-4d69-b12f-c9e7c4a86f60", "comment": "Malware payload", "value": "e6a4812c44710292cb26d5bfcadded3212d9261b624c67b2ec61d821ba21805e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772933092, "uuid": "c28fdfcf-585f-4af1-b750-e97f1eae8825", "comment": "Malware payload", "value": "3b1ca4e6b66649ac6953f9a693873794ff41670f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772933092, "uuid": "33235cb9-dc34-4433-93b7-9dde340d18da", "comment": "Malware payload", "value": "35d51c986af3974e922a1b981b6717a588d7b85d85157b946b1b9e6aa21c70cb7872e7020ee3e43ef803e4fe30247a59", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772933092, "uuid": "324afaae-adb2-4800-900d-49f790b804e2", "value": "T114087C42A3EA05D5F9F79A3489E65213D673BC063B3082DF325C172A1F736E08976B61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772933092, "uuid": "301bb960-ca7f-4815-a297-aafcef817c7c", "value": "8062a445f5cd940b5daefb09f80bc2a2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772933092, "uuid": "7b6e7e05-d092-497b-90d1-7309acf61e06", "value": "393216:O9UZyW0PYsIUmgB9S7QJrojJgVXIXT9fN3aoIKF1H5XMutmnnY4nZFUT7HihCLJ+:OJX3mcLmSh81vxOtxth", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772933092, "uuid": "12f132ff-c69f-4004-b5fd-2176dbbf1670", "value": 82282496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772933092, "uuid": "f36c2ab4-7eb2-466b-81d9-4d128794d5c6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772933092, "uuid": "c98584fc-ddc7-4e65-9a37-2a308fa6a496", "value": "EsLaunch.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9197ae1a-1ae3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772970012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772970012, "uuid": "cefc1d1a-cb06-4a82-b0a4-0ced132c4b70", "comment": "Malware payload", "value": "8a52c59568c7b1b185acf5d56fbb8490", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772970012, "uuid": "fc600969-d2a1-4eea-b076-90f6ea1c9ec2", "comment": "Malware payload", "value": "e807be75045514f477ef6ccaf07f211101a3df7c14971550bb80a14aa20ab00f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772970012, "uuid": "95abf265-acd8-4a32-bcc0-15d4248b4877", "comment": "Malware payload", "value": "1772eab2e29c8aff62cfdac06cc174d2051db159", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772970012, "uuid": "01bc7e38-c648-4861-94f2-c7e2ffa0aade", "comment": "Malware payload", "value": "db41c9ff72bf71a5c116a0b97fa396d2a671ed407ef19b0234f83ed2419d9fd0ae4898d80b425a96d7567ecc69f44e5a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772970012, "uuid": "e67efc61-1f73-421f-bea8-e3752a5a6f0d", "value": "T1D3C3E0B69D2488DED4522AB160D6CE03DDBDB6C6866586CF4C82A1D54F303C377AA13F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772970012, "uuid": "bb3bf24f-13b4-4931-8e8d-0bf081f9c25d", "value": "3ff7f3b391f8291257c83518cafe1759", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772970012, "uuid": "da11197f-4457-4d3c-bb78-3d4f829ed61d", "value": "3072:ys5RXJSZNBaS6eRGzvJiGx4hQ7Ut99/EXo1N9QO0Te:Zyv6eAz5x4m7+qXor8e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772970012, "uuid": "1a12b4b6-c50f-4386-bae7-d7edfd270b78", "value": 126424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772970012, "uuid": "a7510eed-7176-42a2-83e8-9d5a3971d76b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772970012, "uuid": "64789802-f134-43e1-bdc2-42869af36f6b", "value": "Ndavio_Contract_Viewer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed9ef2a7-1b29-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773000231, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773000231, "uuid": "6c278a36-4929-4805-a7d4-a4c4302783c2", "comment": "Malware payload (Mirai)", "value": "14e3e7e2a60e6a9cb0b454d0897e25bd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773000231, "uuid": "a106dea8-d33d-42fa-b45c-1d32e0059861", "comment": "Malware payload (Mirai)", "value": "e8c11c8deaac66beb3b23999472bc4743c701732f94dbac2cde3c09ae68550ed", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773000231, "uuid": "66685319-055d-4c68-9914-98bbfee52900", "comment": "Malware payload (Mirai)", "value": "581f2fd7fe1a9a4dc4f37062673f079d82740cb4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773000231, "uuid": "a816d31d-d57b-4476-a2e6-1dd3475d598c", "comment": "Malware payload (Mirai)", "value": "0708a6e528225d4d7fe0bb25b7cd1bb8d370a82ffd42b1f72e3e707701730ad62a473c873c47b7d0b4d5f5a94435f5a3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773000231, "uuid": "a3aece7d-d897-4fae-9807-52c42b28b0cd", "value": "T1D7F30B46F9428F12C1C211BAFA5E464D37137FB8D3DE72029D24AFA077868EB0D76616", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773000231, "uuid": "27dd7ab5-a3b7-496f-9ea0-4f8980faa3d5", "value": "3072:SqAkhTiyFip7g4XK8BIk+aLH8eMr5o4YBYoY96:SqAk1JipvXBIbaY/o4YBYoY96", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773000231, "uuid": "7d673dba-9d07-4d8f-90b3-6c689cf385d4", "value": 157944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773000231, "uuid": "4a2e85df-5632-43b0-a5d5-8df6b607be84", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773000231, "uuid": "78097278-767c-4fef-9854-d93fe7b3cfe9", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39f157b9-1abd-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772953544, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953544, "uuid": "a64025e7-7bed-4b58-90ef-5f176733b37d", "comment": "Malware payload", "value": "ec5256376b0bb8b8bd8fe6e0d3adde55", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953544, "uuid": "36bfa723-932f-4c88-987a-759ccd6d8b50", "comment": "Malware payload", "value": "e8cd725f8207395f2997dd8d3398ffd0952070be433ffedcfdf0b15f7b0f434f", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953544, "uuid": "3b808e76-977e-45e2-af61-37ecee4aa39a", "comment": "Malware payload", "value": "021a031726dcd32e1ee41f2155b25747359dc986", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953544, "uuid": "7f42f9bd-69fc-4c8a-8b78-891c6f08de6a", "comment": "Malware payload", "value": "cb4d058f49397b5675426136b801ed738418a431c794035342825fc4ea153274e91457284465c6a406305c2dc919c4b5", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772953544, "uuid": "dae60716-dd06-41ee-aff8-8629ce6e11e6", "value": "T1E482A62A8D09DFF00A7E325175AB6816A9100366B938395D3D4FC4AE3F7A554CBE01EE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772953544, "uuid": "1ea2cc4d-b991-4980-bdb3-7d7e0e9b8ac7", "value": "384:KuaUuhSL+xzYGSVhkXrZV7tYuhg+TujiCRnn76v1l7U3jmh4QFC:KuvGSrklVe82o7qu4QFC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772953544, "uuid": "a0bd37fd-1cc6-4786-bcbb-8dbb5b1561ae", "value": 17946, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772953544, "uuid": "9f3bb335-d99e-4688-8650-ac19424c52ad", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772953544, "uuid": "c9633287-5ab5-41a1-a1e0-21d15cb465b5", "value": "ec5256376b0bb8b8bd8fe6e0d3adde55.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca741282-1aff-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1772982134, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772982134, "uuid": "d69726f1-bc33-4811-abe3-c6b49a86836c", "comment": "Malware payload (Vidar)", "value": "bf0633684a0df1b983d1db376a737854", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772982134, "uuid": "d2be0b1b-8981-4818-babb-bb1dddcef776", "comment": "Malware payload (Vidar)", "value": "e98bad4e121ff1b0705f2f7140bfeebb3bc826cb01abdb8cae199df7a575fa1b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772982134, "uuid": "c1d3eaa0-efa8-4cda-aee4-d12c9cfb6efa", "comment": "Malware payload (Vidar)", "value": "7eb2f133e663aacaef7177d62f1f534d6198c74e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772982134, "uuid": "480e8d68-b4aa-4b5e-b1b4-4d337ecd22c9", "comment": "Malware payload (Vidar)", "value": "d4dee346910a52a20151fd0c02699659073447c4d6c4653c4ba5761ef5e4666b1f67de7f50fb5acf65c2ee870349548d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772982134, "uuid": "36ed2ea8-73af-4223-95b4-65478385c82a", "value": "T140C56B07ACA508A5C06EA3769CB782917B35BC580B3A23D71B6766786FF37D0693C710", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772982134, "uuid": "ee8a33c9-5fa9-468b-a126-7910e968a6ce", "value": "1ee5ceaa8651bf31ebd235088b7e8b9c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772982134, "uuid": "2f1c8832-7f6f-42cf-8f59-103d3cd16b2d", "value": "49152:0+MWf5JTbj093Ydb5feIi4NBpf4rD4MR4Ez+:0+/f7hfet4N3f4Dz+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772982134, "uuid": "1bb02847-e864-451f-8e2b-8b0c643b94f6", "value": 2573408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772982134, "uuid": "8d07b300-4843-40c2-9acf-dc0be937df7a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772982134, "uuid": "92531416-f99f-45e3-999a-d4adff1c9165", "value": "intl.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77a4102e-1b11-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772989726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772989726, "uuid": "9f0bf5fd-6826-41aa-95ef-eeb59207f69a", "comment": "Malware payload (Mirai)", "value": "9e8cc3c7102802a50c406f9d04f91ad2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772989726, "uuid": "0dd3393c-6347-4484-b410-594c5e9e8c20", "comment": "Malware payload (Mirai)", "value": "e98e177d3a7eb706b93d16957bc51b9fe3937d1972504880c246205f3d9e26ed", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772989726, "uuid": "cca22cde-a0a8-4b44-8b9b-ef9e38aa957e", "comment": "Malware payload (Mirai)", "value": "88754151b75583b6014ceea4f7c3b1bbdd09f045", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772989726, "uuid": "e731ba26-b2a2-4798-b828-decb70ea8f4e", "comment": "Malware payload (Mirai)", "value": "4bb048d0e05bc3d53a02e32a3d163f48806be50265d5901549d57f326f80e8afa4684ab5fef884ccf4eb8aa689c563ef", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772989726, "uuid": "5f050735-e120-49b2-be90-ed06bc8135c0", "value": "T188F55A62F891DE93C6C0567ABE5EC2D877131774D2EF72028C0547283BBB96B0A7B152", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772989726, "uuid": "60959aed-6907-4b5f-9334-b295f2ca8b7a", "value": "49152:A2NWYlKePvQFIXpOwdnB+vnIftr+UfWCQPA:b00vQZyqnKNWCV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772989726, "uuid": "30abab2e-d7ee-45e5-81a8-08032a912f6d", "value": 3549544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772989726, "uuid": "63030bac-b900-43c6-9576-1bd1594ee2c5", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772989726, "uuid": "36e7e945-1018-4190-a82e-c762e1417a47", "value": "armv7r-linux-musleabihf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "175c7692-1b0d-11f1-a769-42010a9c0008", "comment": "Malware payload (njrat)", "timestamp": 1772987846, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772987846, "uuid": "982a8152-138a-4e06-ae21-cff4bb0f9566", "comment": "Malware payload (njrat)", "value": "f19acf87f83b642f001981d54d089b91", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772987846, "uuid": "eefebc84-279b-478b-b580-d6d5c34c3084", "comment": "Malware payload (njrat)", "value": "ea98a9961ae6a487ba1f6f438cf1aadab054c9494be96f7c146e02b874d26ca1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772987846, "uuid": "43e5608f-2860-4568-9146-c286e50a9c9f", "comment": "Malware payload (njrat)", "value": "4d142960606149a980cf487c30b86d6c62de871c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772987846, "uuid": "c2c0794a-7d8a-44de-b3b6-b7113c896e7c", "comment": "Malware payload (njrat)", "value": "9a27a6c5a98309cda16694da27380019d5dba7ab94f40d2d6e38b1adcdfd9252117109adfbc12871d98840529adb054a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772987846, "uuid": "21e4e670-0f31-498e-95f2-ae99ae0cc028", "value": "T142A36B8EF7A58EC5E35D0D7B8933D01842E9C09BB927F77F28D81AE51C364D88A4E851", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772987846, "uuid": "4daaf021-39cd-47ba-81a4-3dd896cc2c66", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772987846, "uuid": "cb0f8cfd-c2bb-4ad7-b42d-5aa88a90f1cc", "value": "1536:9Eevyt73DDv3NuKG1sV6CR0iRkqyfPA9bnUL3K4LvgqVGvM4WR+VFcyybZDk7zdI:gPNuKaatKKq3K4jb2M4ZcXbZDkXdI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772987846, "uuid": "2704c2e0-bf74-4b59-8b89-02e5e2143463", "value": 98304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772987846, "uuid": "4711d866-72d7-4d74-94af-e9408d3587f8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772987846, "uuid": "4c2e90b1-9078-4969-97eb-e39e8e20cf85", "value": "f19acf87f83b642f001981d54d089b91.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0ca6096-1b0d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772988184, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772988184, "uuid": "4ccfd8c0-23ff-4277-b689-9a9b9a85aca8", "comment": "Malware payload", "value": "c1ef475c1193d7d69914e3fa66f8188b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KILLAV", "colour": "#242D8F", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Themida", "colour": "#A0DA3B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772988184, "uuid": "34652e95-e59c-4a67-a633-874ce2ffa565", "comment": "Malware payload", "value": "eb3bc08e16d1e7c048aef7ffe3298186f452ce57c6301463d9cdab55af2b4f83", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KILLAV", "colour": "#242D8F", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Themida", "colour": "#A0DA3B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772988184, "uuid": "48885a09-887d-4507-9f3a-38748b03043a", "comment": "Malware payload", "value": "529189324f113ac4a6fab357433b46d81f1648e4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KILLAV", "colour": "#242D8F", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Themida", "colour": "#A0DA3B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772988184, "uuid": "32a333ac-9f7f-4a50-8d72-4d379bc7c5fd", "comment": "Malware payload", "value": "e9988f60697aca1b5cac6f86ba1cc0f9abe90195ce6a3cb9ce1075dbcd75b308e6f720c3da8a2311a4145e2cc5b5e34d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KILLAV", "colour": "#242D8F", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Themida", "colour": "#A0DA3B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772988184, "uuid": "095236f0-5855-4f68-9370-84dc2576f744", "value": "T10DB511C326EC5E76F851E53E2935E06A37FDAD9E0F1197C0218CF65A0CB0B6622D2539", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772988184, "uuid": "dea85231-db37-4163-89ac-49de53a902cb", "value": "da5d877efd310691e215f8c2424f5b24", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772988184, "uuid": "0ab81108-0141-47a7-a157-2edcf86e5735", "value": "49152:lvT0NqdT8CZP2Kj/IE8XOPecpIc/rv1J4N0hQ1B9OtPc:t1Z8QTjIEYiwcHDmSPc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772988184, "uuid": "28a4e8a7-9be8-4cba-861f-2571cbe60c15", "value": 2308608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772988184, "uuid": "33eac839-92c5-4e9b-accc-222b71f6aa7d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772988184, "uuid": "7d1b3bd4-c995-4fb6-8359-fd25197e9f5d", "value": "\u4e00\u4efd\u975e\u5e38\u91cd\u8981\u7684\u7edd\u5bc6\u6587\u6863\uff01\uff01\uff01xcod.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f25c003-1abe-11f1-a769-42010a9c0008", "comment": "Malware payload (DarkCloud)", "timestamp": 1772954063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772954063, "uuid": "6c4ce96d-280c-499d-8825-dc341a8128fe", "comment": "Malware payload (DarkCloud)", "value": "a37e293121ecd5f48b4bab66f0c5452b", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772954063, "uuid": "2e91d1f0-3336-4f75-affe-4d4e220ff8b1", "comment": "Malware payload (DarkCloud)", "value": "eb6239810737de1fc6a3ab8366addaa78b6271f795fd5b10d23a4c588aaf7810", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772954063, "uuid": "945866ef-07a5-40c9-8a05-a9c9718e7d3b", "comment": "Malware payload (DarkCloud)", "value": "893cf4f9df1cdc1d268e76cc991d9d000fefc673", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772954063, "uuid": "b4cccee6-4de3-4bad-8282-6e2113edc2de", "comment": "Malware payload (DarkCloud)", "value": "4096046749bde4b8cadf104e02a2ee084bbb779c32a5cedd8291e2363a23a317a9146a0e31c86ff672a7bb845ff19867", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772954063, "uuid": "d132ac91-391b-4c22-a1e7-d8898056de18", "value": "T1C4E2F829BE360D1701E2AB49C4BDCE547D17C339AED26316C1D7098ABA19DFB81DD82C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772954063, "uuid": "5875dbf5-849f-4b11-b2a0-e089b1a8e01a", "value": "384:iIW7xCZfvzx1dZFpULJKVOITzZXOynlj7NDrXc8C:q7xcfv91dZDULsVFzcclj7NDrXc8C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772954063, "uuid": "1178e814-5008-4b84-ad67-50914c9dcdf3", "value": 33913, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772954063, "uuid": "b9f930f5-904e-4ec4-8e00-f21b502d8f73", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772954063, "uuid": "ae58b9b7-6d05-40da-adb6-8b4985eef9a6", "value": "a37e293121ecd5f48b4bab66f0c5452b.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa351314-1b30-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773003259, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773003259, "uuid": "4e789df3-1f18-4af3-8574-4132743b64a0", "comment": "Malware payload (Mirai)", "value": "54bac7f57a3c194a6cbf51914c57548d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773003259, "uuid": "bf9ed05e-3fb1-4a58-a24e-e8628f2b9993", "comment": "Malware payload (Mirai)", "value": "ebeb8ce2a46604aa48fa6f4cda37c3742d7e58b8e4e92dd2b1a2acb3dc4975ab", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773003259, "uuid": "01eb8c20-9132-402e-8d75-701cb98eeebb", "comment": "Malware payload (Mirai)", "value": "15d9a88e5091e77ab7ab1eb7964285e0812fbb15", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773003259, "uuid": "5894ee40-e97b-4b33-8a16-f63366ae40a8", "comment": "Malware payload (Mirai)", "value": "a13946e4941317a68576841e41222c9468762a0f0b02bcb207e3cee559b3300b24952947b72255d02313938885efb5ef", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773003259, "uuid": "ce836c85-e4dc-4bdf-a707-1bf9054c36e2", "value": "T192933A02B31C0E57D1A309F02A3F1BD187BEA5D121F4F689691E9B859675E331486FCE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773003259, "uuid": "1ee56a24-9799-4925-987e-5ec4c3a481df", "value": "1536:xyFQz2A1C9HThfrOCY0lzG/lOvagdh2QnHTEUyehKcXqjkMgNapq+oqpOy+xIEHJ:UM2AkT5YN/TiEYYJ2aXofBp3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773003259, "uuid": "6ba2659a-1aba-40c3-968e-5a787ad460ae", "value": 91976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773003259, "uuid": "81c7a22f-3ee0-4083-b1d5-72dae01e2550", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773003259, "uuid": "24a1c1a6-eec8-4556-b7fb-b64dccc6e2e5", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fff4a9a-1abe-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772953903, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953903, "uuid": "eb34be80-1690-47d8-8689-4f1fec0f140a", "comment": "Malware payload", "value": "ded72ceb16b0a10e31d640a4a0439577", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953903, "uuid": "65d36b1d-76cf-441d-954a-aacb884f65f0", "comment": "Malware payload", "value": "ec4bec16e93347cca423593b954412207a60f28e21ca53ca440e7e2f1f971c45", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953903, "uuid": "cd137548-299d-435d-87e0-6b5b540e6d28", "comment": "Malware payload", "value": "1c5b187f321b2cad5d424491379e8f5e1264ab8c", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953903, "uuid": "3af6e38d-84cc-4b22-bc95-d82fb162e3f7", "comment": "Malware payload", "value": "2c5dda475f7cc06878b540a0d289a4d9f0b31e8c569a80ece98775c434777096efd6339386a62cf36e1b30f898b9df7f", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772953903, "uuid": "7bd46495-8648-4740-b79c-abecd9af2d53", "value": "T1F5D2329C2EEFA268134E30332C6BB496F26DDC8CB55DC864E3E25CD9F85C3089579958", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772953903, "uuid": "90a7fc5e-8ee2-4313-b376-cecadea2deb9", "value": "768:k5AtHMiL2YxQ4av0dHk0PjOajZmw3A/lFni00J5BWmJ:bHMiL2h4d9790/lFni0yBP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772953903, "uuid": "e5bef806-7ba1-414d-b8ee-2087b1fe1d73", "value": 30821, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772953903, "uuid": "c293bbc6-1dfb-4082-b5ac-4a367cd69684", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772953903, "uuid": "abcba116-5d7d-405e-b398-73d72071a8fd", "value": "ded72ceb16b0a10e31d640a4a0439577.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d0f18a5-1b11-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772989762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772989762, "uuid": "70408702-1deb-4efc-8fd5-3a5ea2fbe7e6", "comment": "Malware payload (Mirai)", "value": "527288cebaf6602979eff6dc767e361d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772989762, "uuid": "f3ed14e9-17be-4cee-87cf-cec94e92467c", "comment": "Malware payload (Mirai)", "value": "edae66f99f418d2881d96478cfff0fb3c297e72ec3be72a33dacac27402b941f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772989762, "uuid": "a70c99d9-e007-4892-ac47-ad541be02e57", "comment": "Malware payload (Mirai)", "value": "d0d1fe5f6d18114c0a07ec7a528b47724fa35f39", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772989762, "uuid": "a69e9b58-aebe-4999-9593-9e9153a5e014", "comment": "Malware payload (Mirai)", "value": "18b0d6dca8acf805b5c2ec7b2a9abba4373807bff0e962931a86530dc8901ae3e6716b6c144a4a7c0edfcc74912f59e8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772989762, "uuid": "b534e637-9d9e-4a9e-abdc-d848c9b75beb", "value": "T1A1F55A62F891DE93C6C0567ABE5EC2D877131774D2EF32028C0547283BBB96B0A7B552", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772989762, "uuid": "ca00aaed-77ed-418e-b833-1f8835bc47ff", "value": "49152:BU4WFAOW/vQFB7wEHUC2aX+w/wr+b2WCQPA:w3MvQZz7+jLWCV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772989762, "uuid": "f319ac79-6393-4e3c-adc3-05cb7e33cddb", "value": 3549544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772989762, "uuid": "a893117f-c219-44a8-8ae0-f06e32b673b8", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772989762, "uuid": "f9d5b989-b6e4-4be1-9a4e-9234a7eb4a91", "value": "armel-linux-musleabihf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "894e61ad-1b18-11f1-a769-42010a9c0008", "comment": "Malware payload (Stealc)", "timestamp": 1772992762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772992762, "uuid": "7db4ebe9-6b48-4300-903e-387b61162dc8", "comment": "Malware payload (Stealc)", "value": "5d8c4b1886c9afb69db7319217c30f6f", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "80-97-160-190", "colour": "#FFCA15", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-4689", "colour": "#B10FFB", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772992762, "uuid": "b73951d3-22c2-493c-b1f0-64537d7751ee", "comment": "Malware payload (Stealc)", "value": "eeb056e26b56ee5a3ba4b48a16582eeff5eb313f64c15344e6926d6a589844ac", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "80-97-160-190", "colour": "#FFCA15", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-4689", "colour": "#B10FFB", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772992762, "uuid": "0d8c4b47-2034-49e0-94b9-3d172287fcd9", "comment": "Malware payload (Stealc)", "value": "c54c6616ec67d96dd285d5b14093582855130aa4", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "80-97-160-190", "colour": "#FFCA15", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-4689", "colour": "#B10FFB", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772992762, "uuid": "38d2aaa1-98f4-4069-98b5-59c88e0fc63a", "comment": "Malware payload (Stealc)", "value": "34b81248761514eface5d42185e656a56470a4205509110f00442e6f4786968d7335119b42ca188d6ebb966a4177a283", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "80-97-160-190", "colour": "#FFCA15", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-4689", "colour": "#B10FFB", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772992762, "uuid": "7c635924-19d8-4a6e-a2f5-c4530bd48b3e", "value": "T1F406331D1FF95DDD4CB417AF50F4B884CA4AD23741F2BD50232991E4DCA894AAAF2A0F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772992762, "uuid": "2c97659e-c3da-4da9-a6b4-17a3093ae634", "value": "98304:G6S6xPMHq4RJJvYNILsMg5kJV2/Pqgo1swa733+ZQ0:fPMK4RJi6LfJVv9swa73OZQ0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772992762, "uuid": "39a28db4-d206-4690-87db-8ef9bdf5ac79", "value": 3749843, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772992762, "uuid": "777f0db1-70f9-4183-a7bb-10b85ff43d8b", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772992762, "uuid": "714dbbcc-6208-4f12-a4f0-d7bcb0f7a470", "value": "recuva_professional__technician_(2024)_full_espa\u00f1ol_[mega].7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef68b9cc-1b29-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773000234, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773000234, "uuid": "94fbd583-41b5-4f0b-b7a7-d5b0a68d270d", "comment": "Malware payload (Mirai)", "value": "d25707a2ae4f2782d1450fdedcda86f1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773000234, "uuid": "5f66f5d8-7144-4b42-868e-758f73e3f5d9", "comment": "Malware payload (Mirai)", "value": "ef4b2659c2f627392e9070ea2bad4636b95a3734811df1728f32fd77b24134f6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773000234, "uuid": "7d567ba5-1c92-4e4a-9fb2-45940c74419a", "comment": "Malware payload (Mirai)", "value": "35925bd46930b91339b641978f0fe582dbd532e2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773000234, "uuid": "d922c7d8-6d06-4c78-8896-454aea45f800", "comment": "Malware payload (Mirai)", "value": "5ee037d6172649e7f5d472043482821c8311f62973438179a473bff09cc81feb3cba3ea239b9bce02402140c4a3f3449", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773000234, "uuid": "c7089f12-6e49-46e4-8db9-155a5b80708e", "value": "T180E3F946BD418F13C5C322F7FBAE42883B266BA9D2EB7103D9257F9037864DB0936651", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773000234, "uuid": "a1a6423a-90e1-4b6f-8f45-b23cb36ef472", "value": "1536:wF9RsvAkyD9+H47MaeHX9bRZE4T2vJX4VpRITVzwCHaO/Fqtp+lHSwyw73IcuX63:wF9RXMDXFg4Tc4hIpzwCH7iIPKYo3Dm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773000234, "uuid": "5c93127f-f0d8-4aae-9b00-c4aeff23fcab", "value": 146804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773000234, "uuid": "eaf38431-ff96-4140-9ded-bb2edec9682d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773000234, "uuid": "e52e5e2d-f33c-4e32-aed3-720e512c4e1a", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c069c15e-1b25-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772998438, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772998438, "uuid": "35773cda-67bc-4ab0-a876-715fc3d88cc8", "comment": "Malware payload", "value": "00b25ba27501fa28e31d298240fbdd1a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772998438, "uuid": "6ac72657-51be-46e9-a79c-dff17996a8c3", "comment": "Malware payload", "value": "ef838feb7da5f2375104712d6ddf3eef1cffc8f7899d877806205df69995c487", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772998438, "uuid": "cde69755-ecbd-4680-8e32-072bdbb2eaee", "comment": "Malware payload", "value": "3e6b8dcb0f4cf076fcc67866b34712a0fc5891e2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772998438, "uuid": "68a38f2e-f1b8-4685-b60b-b2dc9b5938f9", "comment": "Malware payload", "value": "a9723cfb76df59b0993b4cd28d8d87c49811838f5d2b92d659f146bd35a93ef82590e3d89926da142d55538879b60502", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772998438, "uuid": "282ab6f4-2d25-4783-ad82-44346a2fa081", "value": "T1B8D57C03AC9588BAD056A335DCB662D2BB35F8480B3623D32F6366742FF67E05979740", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772998438, "uuid": "7597ae87-dbfc-4246-ace5-bbdbe37ddc06", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772998438, "uuid": "558d3619-b564-405a-a768-1c29d0966cb8", "value": "49152:GVW8Toc/Kv8U1B60kUEZBNvXyaEuRuNqid5pZf5ee:GAXYgVkUEfhEIQqi5ee", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772998438, "uuid": "e8a278ee-2160-4cda-9822-a39000483491", "value": 2758678, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772998438, "uuid": "ac3a2cb2-e126-4d28-a176-dc8b202eacab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772998438, "uuid": "4ef264a0-22b2-4dda-b6ab-3d38b8e69c3b", "value": "intl.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8828518-1b30-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773003229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773003229, "uuid": "3bec8d02-d282-4486-9859-baf3ca9a6d46", "comment": "Malware payload (Mirai)", "value": "6ab6eb5930418c7a30cd7ce2fa4ae230", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773003229, "uuid": "f1a120e1-26c0-40ef-aaea-69ec04b4fb6c", "comment": "Malware payload (Mirai)", "value": "f039abbe054eac09e0da661782f97c992be478c12d4f064fbad2179a3215b0df", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773003229, "uuid": "ad169e97-c4d1-4d54-b3b4-64a45fa7fa03", "comment": "Malware payload (Mirai)", "value": "7b5e16c6c625a9020a15c91a4ebb7819c8e2d4ae", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773003229, "uuid": "aa1cf301-1fd9-4e2e-8643-15c91958013d", "comment": "Malware payload (Mirai)", "value": "1fb3e93e2c6c8092bb4e5da3da86c6931c18cfb07fac494f7f6a122bd6695aaf39af71cd5cc30e4e6475d8ea8e981cec", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773003229, "uuid": "1295db91-224a-4ca0-a647-1b80a6225b74", "value": "T1F613E168E1381AEBE5BFAC335C23C0813B7473C97CABC4C6E5D3CF126D565619240AA6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773003229, "uuid": "848a6fef-645a-4ade-87ce-21a2b64a21d3", "value": "768:t2JCFCB4J4GnDRF/K0ohgxptOd7IVZ0ZDONvpTvno5/KgGy70Rfki04uVcqgw09M:t234WkP9ouptA7YZ0ZDOnTvnenwW4u+O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773003229, "uuid": "b6b513ba-af50-43ba-8c16-2a5ee2992d2a", "value": 42176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773003229, "uuid": "242eae4f-8bcc-453b-8b79-6aa4709de05f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773003229, "uuid": "75e24cf5-5710-4f1f-b75b-d1ca7dcdbb1f", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "437aba0e-1abd-11f1-a769-42010a9c0008", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1772953560, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953560, "uuid": "e7669eed-269a-4d2f-b812-cea3e9b4f074", "comment": "Malware payload (VIPKeylogger)", "value": "1616bf0542cd8602c6f96fa8f3c0f8dc", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953560, "uuid": "71b1c788-854c-4b2e-ab28-7a61a5891145", "comment": "Malware payload (VIPKeylogger)", "value": "f05e46f6fb1aae02d7a0eb7564bb9b43da8a0536d6e75c7ce2a98c524cd65d6c", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953560, "uuid": "0cb67396-b000-4689-98f5-18542705c8f0", "comment": "Malware payload (VIPKeylogger)", "value": "444f74678c9b6d0421336b85abfd35033b7cf2d0", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953560, "uuid": "f42c9a7a-a08f-49f7-8024-6ab2af54a16d", "comment": "Malware payload (VIPKeylogger)", "value": "096ec270bd227652557e21039e8f99f6feb1f67e38533ea5075c174ac42eac2bc55fd01556434bb69a07e63297fefb4e", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772953560, "uuid": "a8bd5341-6360-4745-80c0-37cf50941fb5", "value": "T1BD82C760DE860298599715FF8C893D78E5349BB7042D00ECBD5CB328A70C2A47E6BF4E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772953560, "uuid": "6b4f7457-781c-410e-96d2-4f7b0ca84756", "value": "384:vau2pC+f2veDHzcGQNfbEOBgHtpPd+Q5/RhvpqLs7tN:vjKfAV3NYOBgNJdF/RhvM47tN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772953560, "uuid": "36372938-13cc-4202-b40d-3726f91adb63", "value": 18404, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772953560, "uuid": "9549799c-7085-4ec3-a09f-99193135db15", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772953560, "uuid": "3b5e2cdf-3903-4d10-80e8-11847d642999", "value": "1616bf0542cd8602c6f96fa8f3c0f8dc.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a07882f-1b15-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772991287, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772991287, "uuid": "fc0d187b-14fb-4d46-b766-e1de85848bdc", "comment": "Malware payload (Mirai)", "value": "7c33487e82aac713b4a1209d34a7feea", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772991287, "uuid": "30f44fc3-782a-4b44-9799-eae71ac71b18", "comment": "Malware payload (Mirai)", "value": "f0906eb7fcc09866de5a4b60306484b56e26b49851c88a40211e21118a45bc1e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772991287, "uuid": "94996b8e-e73a-4226-aef2-e2f595a67d9b", "comment": "Malware payload (Mirai)", "value": "c40e3e9a1f0750e2da4f455d42eb910d4148ad1c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772991287, "uuid": "72be98df-3460-4a1a-953f-0b919227c4c4", "comment": "Malware payload (Mirai)", "value": "dfddd2751c0092e91474d88466abd5648fca6311b910f3f8ad99839f8432aee4362d0ecd22f960b6e0181f2421d98b36", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772991287, "uuid": "ec32a6a6-dcf5-4e7d-98d6-afef2d4c04b9", "value": "T1C804881D6E228F7EF668873147B74E25976C23DA27E1D640D2ACC1106E6029E641FFEC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772991287, "uuid": "3320c173-de8b-4977-99e6-7226fb4046f5", "value": "3072:jg57RW7LHZwbq1YSBan1yvbysxr1uGSwI:jglRW7LHZ0Bqyy1BSwI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772991287, "uuid": "7d155c2f-510d-4542-8cbc-3f3e47a27f26", "value": 173888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772991287, "uuid": "44c8e358-f137-466c-8d0a-4ab178736129", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772991287, "uuid": "e839d293-3ad0-4675-aa21-ea8f12d23b04", "value": "main_mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7892b9ae-1b2a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773000465, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773000465, "uuid": "005c06ce-000a-42fb-abfe-c4e034827edb", "comment": "Malware payload", "value": "1982a0a7d49b6b5afcd5eb022462e602", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773000465, "uuid": "9ee756bc-5620-4454-aa5e-23a9698deac9", "comment": "Malware payload", "value": "f0a9dbf239d869284ff202ba61c925b9e048489130919071b0841edcddff62ba", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773000465, "uuid": "0c521e39-3d9e-4e76-ae20-d1da252ac96d", "comment": "Malware payload", "value": "85e3b0be8f6de89b0745e53c5b30eea8f11f9e20", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773000465, "uuid": "757ee4aa-2e86-40c9-ad81-7d8b325eaee1", "comment": "Malware payload", "value": "37c2b6c52bc1666c1b3c2f95f63f4b237e262e8302e55e681e8fa372b93f23202ea8722a01b6f6e8092bfabcbba8c029", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773000465, "uuid": "259492f6-c659-4329-ab72-29a1112afa5d", "value": "T1A5924CB906497C79BBC0CE799F3C7F0CAEE582C42129E39DBA1F39705A2065DC609359", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773000465, "uuid": "8cde5d62-8cec-4843-912e-18378f2f02c4", "value": "384:qkncuxOLnVYMScJzsO9a4cbddrME8jyfzsO9a4cbddrME8jy4:qvuQL+cJzsP4cbddr7zsP4cbddrk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773000465, "uuid": "40ca75c2-1ac6-4260-83b4-6c89866b4300", "value": 19491, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773000465, "uuid": "b32fd974-3e63-4cd0-be15-462153c2e3ab", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773000465, "uuid": "3d129721-6b96-4974-b157-5be70b4a66fc", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70ce90e2-1b11-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772989714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772989714, "uuid": "d7439cc9-fb94-4053-b323-2ce23399dc7f", "comment": "Malware payload (Mirai)", "value": "9c1d356e24b5f95c35ed9fc2000e0130", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772989714, "uuid": "a59da315-fece-43ba-8f5f-0c380bedd58a", "comment": "Malware payload (Mirai)", "value": "f278bd6fa02955daa928fa2db11aedd6400b64b7a6d630ba3ebc6f405e42bc37", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772989714, "uuid": "aee14023-8c9f-4c02-88ce-12e2064edf4a", "comment": "Malware payload (Mirai)", "value": "fe6ffc28bbf83508adbb75787a73cefeb5155f61", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772989714, "uuid": "7b03283a-a93b-4806-8483-28f916321a0a", "comment": "Malware payload (Mirai)", "value": "24cb543f80e33c63f96ef6ee516386de1417a57a9bca8d353f137a3a3d36596283c6285f9f83cef65914220c0476615b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772989714, "uuid": "5e4be432-8907-4926-94d1-cec16e7837a5", "value": "T1AD4533120DFA6702CE9866FBB731689AC850DD4D7159386A841E7837C7C81E6EFA0FC5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772989714, "uuid": "06b78baf-c460-4fd9-bf62-bf9eea63825c", "value": "24576:nCz7dGWUQaYz+6Lve2MPyFtYbWeMAPxWSj4:CtHUt6LBgyji9NxU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772989714, "uuid": "590bcc09-cdd3-407f-8990-841ffc0a4576", "value": 1208548, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772989714, "uuid": "816c4d68-5583-4b5c-9cf9-0ecff4e8cf94", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772989714, "uuid": "b21aad19-24c6-4da9-9703-1f4ac517e3a1", "value": "armel-linux-musleabihf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "347a2947-1b2a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773000350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773000350, "uuid": "b564baf8-f87b-4e3d-9ed2-e2215b1fa5f5", "comment": "Malware payload (Mirai)", "value": "1787ad4974732780a80c9182491ac027", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773000350, "uuid": "c421e85c-ab7d-458c-b46f-6e16102e4de9", "comment": "Malware payload (Mirai)", "value": "f314951d308615e899e6ec277d3bba3ff80982537abf8423d4179a8d7e34f177", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773000350, "uuid": "bb3349f7-6df7-4dc4-bd3b-4a602df15cda", "comment": "Malware payload (Mirai)", "value": "cdaddfd0bb0bde82c4daeea8571d4ae720bdb4c6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773000350, "uuid": "1bd1c5a9-615f-442b-9be5-d7b785972a5b", "comment": "Malware payload (Mirai)", "value": "43d3e8c437d1b8ee0b1882386b0ed9090104d86a2af365ed84f81f2125d7b8ce6956dc3c3cde30076e6e989a6cf809bd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773000350, "uuid": "b310e935-9ae3-45ea-9a43-37743e486f7b", "value": "T1D0140981771D3E63C1D7BEF026F7D7F143E7A8401BA2A140F19EAE945276AB12409F89", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773000350, "uuid": "e493011f-8453-43f2-ad95-61c9bb99e066", "value": "3072:ItjlHaPxB9fyxyuZvkx48n2/32S/mh0AnY08Y7BKMZH3i1+:OjFaPxnfyxyuZv44Yi3z/mh0AnY08Y7V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773000350, "uuid": "3739a291-1aa8-4b3f-a3c4-e4bf6713254c", "value": 195922, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773000350, "uuid": "4d19fec5-ceb6-47ed-b44c-4cdca04c4b99", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773000350, "uuid": "38d6a8c0-67a0-4662-83e6-44be17de82e6", "value": "a-r.m-7.dick", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44a45878-1abd-11f1-a769-42010a9c0008", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1772953562, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953562, "uuid": "287c0b7b-96df-44fd-8df1-f4c5951168f8", "comment": "Malware payload (VIPKeylogger)", "value": "c0bd47e2936737f07273a9eb2795c931", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953562, "uuid": "0bbdcee2-b1c4-4a7f-b7e5-f0c261c71ea4", "comment": "Malware payload (VIPKeylogger)", "value": "f654b866055f76ecf45df2a4c3eb223312a8b4fc31ac6c081ef243f33c70f769", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953562, "uuid": "eaf20a59-8d6f-4339-b89c-744b04fe3944", "comment": "Malware payload (VIPKeylogger)", "value": "4b5157813739e50e3cfb8bb4461c2b15ec5a4c7d", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953562, "uuid": "382f8fb9-9c28-4fe2-adbe-3d2f0ed37129", "comment": "Malware payload (VIPKeylogger)", "value": "c9e8e65c306000c5bc128f243ca73a913d0644be3c8561ffbf6c78e1ee105836dc67192a69685952fe325d63270732dc", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772953562, "uuid": "3851e989-ccb8-43e2-877e-80f4f650070e", "value": "T1C892A5669A851780629B55FBEEC430299D38CBF2043C10D4B92CF318D71A3757F6ED8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772953562, "uuid": "4a67dc89-82e2-48a9-955b-8a74d47341a8", "value": "384:vaTAjX+frs0wP4M/AjU8xU5XMIe4OHFpW2bHdQK7rBNNlromCatWPS2G:vWeuD1OiIROHFpW4Hn7rBjlromZW69", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772953562, "uuid": "280a9946-1b88-4ef0-9ad5-375197fcdc3c", "value": 20346, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772953562, "uuid": "9cfe0b3d-98aa-4552-92b2-16b15907f4e4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772953562, "uuid": "ca8ae963-e280-4f3e-9218-9432cac0651a", "value": "c0bd47e2936737f07273a9eb2795c931.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ec3f254-1b11-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772989764, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772989764, "uuid": "b9c8d1bd-94f3-4644-8795-fea46716f362", "comment": "Malware payload (Mirai)", "value": "b2eee1ddef52b6e7287630f43eaab25f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772989764, "uuid": "fb90444e-22d9-421c-bc9e-a3d0a9b2d0dd", "comment": "Malware payload (Mirai)", "value": "f6778cb499743f16ec6cd502372352898a611f5bd6c0c52452f37da851612979", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772989764, "uuid": "2785c8d6-b8c6-44b1-9e74-cbd13cbe17e5", "comment": "Malware payload (Mirai)", "value": "0c7acf405bca220fe6047a3292810c6858160dec", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772989764, "uuid": "a6f3eec0-8776-4000-818f-e4659e8b264d", "comment": "Malware payload (Mirai)", "value": "5673dba1f66fb7da9f60ac49fd03888c35e0bdde43a9f79872f6f73d86e8e3de24c918bcb09d43a4e87de8d3ee8a26fd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772989764, "uuid": "d678adfc-b4a9-4b1b-897f-738a9b529939", "value": "T139F54A62B892DE93C6C05675BB5DC2DC7B175B34D2EE3206CD0443283BBBA6B097B152", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772989764, "uuid": "a980f8c8-c70e-4ca0-925d-8a1a34fc91c4", "value": "49152:BseNkbXEtgxfrGxXZATDjBXS/mxr+uNWCQPA:B7i0tgxqzA/PxZWCV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772989764, "uuid": "16c4ef74-ead1-4dff-8e26-6770fc48b952", "value": 3545444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772989764, "uuid": "bfccd9da-fbf7-4a58-9450-7fe447d1dcab", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772989764, "uuid": "22b17094-4c0a-417d-b75b-a061be09ec9f", "value": "arm-linux-musleabi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13b74445-1b15-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772991276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772991276, "uuid": "98561a2a-363a-41a9-8e37-1092a3ac8014", "comment": "Malware payload (Mirai)", "value": "5456039b6049488b40eeae61d8700aec", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772991276, "uuid": "1c3dc38d-342b-467b-ad97-fd1473550d7d", "comment": "Malware payload (Mirai)", "value": "f70d152c4801e2b0b6a5b946aa659759277421672928e2cb1e2884b535e79538", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772991276, "uuid": "f31afd81-166b-4eb9-9770-311adc7c082f", "comment": "Malware payload (Mirai)", "value": "40a33f6fa0f701480930b0716742c3096abd80ec", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772991276, "uuid": "e035c5f8-2346-46d7-a403-fef1edebdb11", "comment": "Malware payload (Mirai)", "value": "08d8ef9f5c6d6b15a1a571f621b75dcc4b7832d66623ff834cb1d130b48f8f167e9fb520cb074672a9aecaafd1235d3a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772991276, "uuid": "d6c9ec69-a515-49dc-a8b4-395349972729", "value": "T13B937CC0F683C4F2E84705B1507BE7379B32F1B9101AFA43D3699A72DC91951EA1AB9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772991276, "uuid": "0d307c3d-18a8-473e-83e3-2f5828be0bc9", "value": "1536:W/QCZaxGdvts3i5JPho0sxPu++4HRsUIKqI4FrS4LSN:WYCZa8dvm3oJPhpsxP5lR+KfUmDN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772991276, "uuid": "33bc60dc-6a5a-4e93-9977-04eadba808fa", "value": 89992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772991276, "uuid": "090ac2dc-6293-4a4c-9cfc-7d975a3e8cdc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772991276, "uuid": "c8adece6-af9b-43ed-beba-78413d6c8b7d", "value": "main_x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba5e5b26-1b30-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773003152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773003152, "uuid": "247ca1da-2535-4ffc-994e-9673b758d6bf", "comment": "Malware payload (Mirai)", "value": "0e1061f968212454d80c2c388de40da4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773003152, "uuid": "7145961a-a04e-4378-be69-5bcb4a36783a", "comment": "Malware payload (Mirai)", "value": "f7f115792515fc1264a8e88377369f8be22b4733030a3d97993c3a7315c2d4ae", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773003152, "uuid": "6e1b5007-fc2f-4cd6-b9cb-862d5f14f624", "comment": "Malware payload (Mirai)", "value": "e3bb10d3726e76ee399c6b3809f76784db9b57b9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773003152, "uuid": "53aa8dc7-1fe1-4bf2-a499-4a4d163a3082", "comment": "Malware payload (Mirai)", "value": "2429a050676d4fadd8fe6bac6840732aec425fc797c4db82bfcd90da173b1bba8778b5b467eae91439897394f58e8157", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773003152, "uuid": "93d09a0f-dd80-41a5-8ae2-adfe2498b950", "value": "T1C716231A1FAF985AD2A059F09AB1C04FE171FB7407BB4713EAB55839C92B7C13D26780", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773003152, "uuid": "00f5c2ea-be34-490e-a2da-5fa85d329461", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773003152, "uuid": "8f1f83bf-bd44-44c2-b95c-8fa3d2118737", "value": "98304:jgZPyyinxZFpNFza6k8qPYPuvUZ9F8zDD:MliDHzabXwPZTF8zf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773003152, "uuid": "49016807-ac36-4f3a-9b10-20d33b8128fe", "value": 4127744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773003152, "uuid": "0840a3d3-0b9f-45a0-83af-158931b7f2cb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773003152, "uuid": "a4347b36-9d39-4e21-b1cd-e4efb190afc7", "value": "SecuriteInfo.com.Win64.Malware-gen.95588948", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21b54d79-1b3a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773007191, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773007191, "uuid": "2aa37355-8240-41d3-a2c4-01401688f296", "comment": "Malware payload", "value": "d9ebf0738350bb92d4779d47100d9be1", "object_relation": "md5", "Tag": [ { "name": "crypted", "colour": "#7BD566", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HiLog", "colour": "#76E75D", "exportable": true, "hide_tag": false }, { "name": "keylogger", "colour": "#66C828", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773007191, "uuid": "d415d803-de04-4b44-b8b4-ba2414075acd", "comment": "Malware payload", "value": "f925e2d67bf1c35afc832e947dc03216bf562c7e545f92f2e79785bb81443509", "object_relation": "sha256", "Tag": [ { "name": "crypted", "colour": "#7BD566", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HiLog", "colour": "#76E75D", "exportable": true, "hide_tag": false }, { "name": "keylogger", "colour": "#66C828", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773007191, "uuid": "14c5efd3-c3f1-44ac-8b70-cf5609a5e5c7", "comment": "Malware payload", "value": "d6efcc4d11a0406cd96ce877279c8cc8aec72a6a", "object_relation": "sha1", "Tag": [ { "name": "crypted", "colour": "#7BD566", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HiLog", "colour": "#76E75D", "exportable": true, "hide_tag": false }, { "name": "keylogger", "colour": "#66C828", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773007191, "uuid": "22add1d7-623c-46c2-b0d7-0f2db10b5d33", "comment": "Malware payload", "value": "e8c64f3924fc4aeb33582dccc9404426b5274a55e4b8e87fa535ef81af997ee6648f588785274473f1933ac50bf94e8f", "object_relation": "sha3-384", "Tag": [ { "name": "crypted", "colour": "#7BD566", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HiLog", "colour": "#76E75D", "exportable": true, "hide_tag": false }, { "name": "keylogger", "colour": "#66C828", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773007191, "uuid": "f704753b-d18b-4e32-a2ce-9d25986677b1", "value": "T1B42349283DFA501AF173EF795AE4B6DAEA6FB7333B07645D205103460613980DE9293E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773007191, "uuid": "5e192042-3b57-4cba-bdc0-23295e720118", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773007191, "uuid": "ff788217-28a6-4d1d-aa05-39a24c415c56", "value": "768:ULpFv1LHgFLl7Q0ZnTTDHXfS26qWXCKTBxOmCr7C6Y5HM:UL9QR00t3a26qsOtfPOs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773007191, "uuid": "d3c21e4c-7a60-4198-ae08-6e90b9375812", "value": 47104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773007191, "uuid": "4b77c901-75a8-4f4f-b989-0a09a5986402", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773007191, "uuid": "4efa43a7-6dbf-4a21-8897-5c15a267202e", "value": "Reaper.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e37b5d2-1b17-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772992340, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772992340, "uuid": "3f328bfc-f16f-4f66-a2e9-3a6f56e9c13d", "comment": "Malware payload", "value": "076480bf23e7e0920d75fe65b1b949eb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "tabbysbakescodes-ws", "colour": "#BCEB0A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772992340, "uuid": "ecb2217f-6a3a-4384-a35a-adad657a2c34", "comment": "Malware payload", "value": "faf3791be825bffb9d60140c80684ea74c770a8b3aff8b0b1ca598c57d68dcfc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "tabbysbakescodes-ws", "colour": "#BCEB0A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772992340, "uuid": "54336e4a-4363-43e7-b218-8dcb24fcabed", "comment": "Malware payload", "value": "1d768e85aa2703987c22b8bb4779080fba6f0443", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "tabbysbakescodes-ws", "colour": "#BCEB0A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772992340, "uuid": "f9f7e290-8e83-481e-880f-95d73a41ac2c", "comment": "Malware payload", "value": "cfc2208935b88b765620276e9f5ea8f4b299b22527223d8bb43b013c094da00b26cad3a29e1f39d4f088ab21924d95a4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "tabbysbakescodes-ws", "colour": "#BCEB0A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772992340, "uuid": "01600599-a22d-45a5-9ae0-22bcf81fbfb7", "value": "T1CEE63302B5C02AC2D38E9E7E73755A34249E4D0C6BEFCB786450F7D3A9F805289856DB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772992340, "uuid": "2e1b772e-92ff-4806-81a8-74d555c368b4", "value": "a56f115ee5ef2625bd949acaeec66b76", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772992340, "uuid": "ba39b68a-6bc7-48f3-9b1a-a584cefaa65f", "value": "393216:EG1RUV0nN+qZCL6KZ3r5SxNdCi+vQcxipz05p1:tK0N+uMD0xNFShRT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772992340, "uuid": "a23438f7-b0ca-4841-8518-e0e740108236", "value": 15032320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772992340, "uuid": "57f534b8-754b-4779-88f8-38e819063ea1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772992340, "uuid": "01ecfb46-e4f9-4ae6-ad98-126a26c01d6a", "value": "Installer_v3915_x64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5eff8b05-1b36-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773005576, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773005576, "uuid": "7ebad821-0107-40bf-8a2e-cf1d73491273", "comment": "Malware payload", "value": "1e1ff2456c6d243c867c785b3ec29758", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773005576, "uuid": "ad71bccc-4d4f-46b5-81c0-62f39aaed700", "comment": "Malware payload", "value": "fb02d5894227eefc38ea58e624b39f0c6f4c17baf9d1958574100ad9ddf0f3f7", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773005576, "uuid": "27064edf-408a-4788-bad6-1d9150d1c2e2", "comment": "Malware payload", "value": "8b0d8b3c6c69e6658486c4bea6b60828db96d042", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773005576, "uuid": "fc35e46e-31e6-4b99-a31b-a72dee7341c1", "comment": "Malware payload", "value": "f0cb8e13cda77af4abedb1dbaf93114dcfe0eb585c8bd87e3bff88c3fbe1ad067bff2ce5a70f416a2e8bbcca8ea04f58", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773005576, "uuid": "32b11cb6-6ef6-4b80-a46f-086f1cbd413b", "value": "T1EE415CAF06614FF39E878A30737044E4D49611E0E8E31EE7B6421D16AE7A9FCBD49784", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773005576, "uuid": "7deb1efc-1a42-42c5-95d2-06d3de2cafca", "value": "24:ici1Fd8VOMkO51rOlOtiO5OcOUxLSI2rdRks/IW/sUgIVqMLWMvOxFEEyWJhLZT/:iHd8k0iUttQ/4LiRfkvM2aELbh3Hz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773005576, "uuid": "73531dd2-5890-44ec-9bd6-04137b027454", "value": 2269, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773005576, "uuid": "484c43ad-df31-4847-8cf3-0b60713716cd", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773005576, "uuid": "47de1d38-872d-4383-81c4-e5b068f6901c", "value": "Sakura.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fa832ee-1b18-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772992665, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772992665, "uuid": "2723cb05-d495-4db2-9421-cd65fdd43658", "comment": "Malware payload", "value": "3f470ae352a5aa088d0fdf283f4ed8d0", "object_relation": "md5", "Tag": [ { "name": "37-221-66-22", "colour": "#9E1FE4", "exportable": true, "hide_tag": false }, { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772992665, "uuid": "d6991b45-c953-4bb3-96dd-5d04ff2b455d", "comment": "Malware payload", "value": "fb6223c829f6d5e0cfc087af75dd54ba31597fa155ee0d95daf7e82790e8f758", "object_relation": "sha256", "Tag": [ { "name": "37-221-66-22", "colour": "#9E1FE4", "exportable": true, "hide_tag": false }, { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772992665, "uuid": "e8e24358-b036-4231-b957-2c355183c5ec", "comment": "Malware payload", "value": "5dea67b8714aa28fa215a5397b12adb86e7f3d0f", "object_relation": "sha1", "Tag": [ { "name": "37-221-66-22", "colour": "#9E1FE4", "exportable": true, "hide_tag": false }, { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772992665, "uuid": "32c266cf-e727-4499-996c-a4531f4c222a", "comment": "Malware payload", "value": "0f05af44e33ba9b4eaffa7ba136a7d8c2e052885e9de684be81ab6408bc2847463181495c115814e9509879fb05e4bac", "object_relation": "sha3-384", "Tag": [ { "name": "37-221-66-22", "colour": "#9E1FE4", "exportable": true, "hide_tag": false }, { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772992665, "uuid": "e507b208-47d2-4b09-b575-967d2823ed15", "value": "T18EF52366A9D070A1E8B84732C1A305F2853AFD7A67A616DB149CF7344B421C0A93F7DF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772992665, "uuid": "910a4ac6-a07c-4deb-95ec-b48304621988", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772992665, "uuid": "afad96e3-1dd5-49ca-adc5-2973713325e9", "value": "98304:Uro9HoeB9MpXHpro9HoeB9MpXHueBbAvlEsxif4hd6Cxt4Jpb7ujZy:UrERMpXHprERMpXHLZAvlnYaTM/7udy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772992665, "uuid": "7b8dfd00-91d1-42ad-af9a-9e231537bb55", "value": 3583998, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772992665, "uuid": "0f8b783a-4afa-4847-a59f-bca1edc6ae3f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772992665, "uuid": "c8aa6e17-6264-4f4b-b2d1-229c525ff347", "value": "Setup_Installer_patched.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bab0c1a8-1b0d-11f1-a769-42010a9c0008", "comment": "Malware payload (CryptOne)", "timestamp": 1772988120, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772988120, "uuid": "4a24d225-ee06-46e1-955e-97b0c49af3c1", "comment": "Malware payload (CryptOne)", "value": "b8071de98ccd7e4d2cf901330047d1fd", "object_relation": "md5", "Tag": [ { "name": "CryptOne", "colour": "#62260A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772988120, "uuid": "dca49a5f-f144-49bf-893c-7ee761b8e0ec", "comment": "Malware payload (CryptOne)", "value": "fb9ae123ff0c6fffe31985dc2c16adb64f760d31bb4a5b6f502046b7d97835ec", "object_relation": "sha256", "Tag": [ { "name": "CryptOne", "colour": "#62260A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772988120, "uuid": "d47d5212-5dcb-4217-a031-676fe0c30f94", "comment": "Malware payload (CryptOne)", "value": "58a611980be40cc6598f19e00fa426eb039080ed", "object_relation": "sha1", "Tag": [ { "name": "CryptOne", "colour": "#62260A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772988120, "uuid": "13210524-3046-4c42-a8ca-add67b49c45f", "comment": "Malware payload (CryptOne)", "value": "543b1cbeff29d2526ca6ea15ad3d1ace461cfe16d0a31ac2501435b7697433c19bb781087ea56f2659b4413111b04948", "object_relation": "sha3-384", "Tag": [ { "name": "CryptOne", "colour": "#62260A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772988120, "uuid": "852c0d30-2a0c-4ddc-8b2e-674f6ec453b2", "value": "T10946F1F1DA90C0DDFC193336BBAA14269C2B690CB5447BFE92949CF2661F2F1A54124F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772988120, "uuid": "c63099ba-d5cf-4842-a1aa-63d33b28225d", "value": "e8450cd9fde12fe86ba788a327b66219", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772988120, "uuid": "0ae2a7dd-e1df-47b3-9e00-6f805937084e", "value": "98304:3xJFxIV3jJglUn6uvD0Ua36KPhwGVaUyuka/D7LuXNNUw:BbxIVlDw3/pwGYvuR/LQNNL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772988120, "uuid": "ccea7ee2-5da1-4a48-96be-43f57a38c4d4", "value": 5591552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772988120, "uuid": "ab45edac-ec07-4a9c-841e-304816096c64", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772988120, "uuid": "d2f45997-256c-41da-a592-f2abc3b27fcb", "value": "2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18d5880f-1b00-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772982265, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772982265, "uuid": "366339fa-2edc-4a4b-ad6d-03c5371d55ff", "comment": "Malware payload (Mirai)", "value": "d8dc1795e409bf11ca59eced684af6ed", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772982265, "uuid": "82505d8a-1792-4e37-8a69-ab0fbdee88bf", "comment": "Malware payload (Mirai)", "value": "fd7c20ef9bbfe7efb843a762cd2bfc8844353d87a07d52a243053d5367f617be", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772982265, "uuid": "ddd0e5be-2112-4711-ae53-e6067682c16c", "comment": "Malware payload (Mirai)", "value": "c3dee61e72523dee0a05db61554c1f911903022d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772982265, "uuid": "ffdd1ef3-064a-4ffb-9ac6-d06d61ac660d", "comment": "Malware payload (Mirai)", "value": "8629f16219bb1b3a12582d6a36aa3ce33a98218771d4ebf1854c3262688bda02c8b463a7b5dccf5d275ff4537cfc4ba1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772982265, "uuid": "b701a55c-16f2-48a8-908b-feb9d5f96e95", "value": "T1B2468D69B57E18EEC575C8B1835F92326D20B81841A1387B65409BF43F66E301F6EFE2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772982265, "uuid": "00e6025a-07f7-41ac-a45f-f71ab5556c8c", "value": "98304:eFE4bbosDmf8FiVDdN9tM6zgxCJp7E+oaXIJfFXYWV42Vd:eaOJhZaS4E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772982265, "uuid": "c7a3417e-efe5-4072-b2ea-d071abfe8331", "value": 5709672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772982265, "uuid": "e02b95fe-e8e8-46f3-9755-252a8227aa7d", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772982265, "uuid": "d549a54f-06d6-4913-80d9-78f04dd9ef8c", "value": "x86_64-linux-musl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e2b2054-1aff-11f1-a769-42010a9c0008", "comment": "Malware payload (QuasarRAT)", "timestamp": 1772981845, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772981845, "uuid": "b899dc77-3b62-4ee4-9c9e-394b9b76904c", "comment": "Malware payload (QuasarRAT)", "value": "88607a9063984ddee3b7d602e68fa780", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772981845, "uuid": "825bd479-7d90-4a4f-ba44-db2d7fe7590a", "comment": "Malware payload (QuasarRAT)", "value": "fd7e11f86e83e09db93060d7b96516a16d28efd2651ff36343ee6e6f209fc86c", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772981845, "uuid": "1b58cb2e-c46a-4a37-ba04-45a1d9dacddb", "comment": "Malware payload (QuasarRAT)", "value": "6f4cdc2f1cb399339a4e1e0822bd7af11c719a9c", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772981845, "uuid": "a645590a-e692-4860-ac54-efb3de1446eb", "comment": "Malware payload (QuasarRAT)", "value": "06a3780e48ed7a90b40f68155b03158002fd643835b7e5f7414d451df738d077ac250da56a2e9211423db3c6e1987352", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772981845, "uuid": "65bacb00-7467-4f67-abbc-57469aeabbf0", "value": "T1B5748D2337A8E97BD6FE077AF432460447B1DA47B216E38B995C52B86C133868D513B3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772981845, "uuid": "a8019d7f-40c1-449f-bdca-2c084b357dab", "value": "6144:r2EHMNHJs22l1ZaAybWokOE3fOSg9CkSWX0wBEYoT:qFps2dAbfOmXMyPYoT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772981845, "uuid": "d3aa7ac3-0498-464c-baba-0e5fa235ae7e", "value": 356579, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772981845, "uuid": "a7c73d3c-28f7-432a-a5a2-e4b6ca5547ad", "value": "application/vnd.ms-cab-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772981845, "uuid": "bd873667-3edd-4bc0-8628-80ef4b16649e", "value": "Wizard Builder.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d20a6fc-1abc-11f1-a769-42010a9c0008", "comment": "Malware payload (CryptOne)", "timestamp": 1772953067, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953067, "uuid": "6616d3bb-e313-4c56-b682-be16fe6260c6", "comment": "Malware payload (CryptOne)", "value": "a53b03929a7598b2e0b7411ee95147ca", "object_relation": "md5", "Tag": [ { "name": "CryptOne", "colour": "#62260A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953067, "uuid": "e21c9089-8f29-4f61-bf4a-d8c038521f30", "comment": "Malware payload (CryptOne)", "value": "fd818a23c808fc4467bdbee6060cbb00326feb4243c10084f7470b30aa91e25d", "object_relation": "sha256", "Tag": [ { "name": "CryptOne", "colour": "#62260A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953067, "uuid": "f78b07e4-50a7-4e7d-a6b8-1da41221e4f7", "comment": "Malware payload (CryptOne)", "value": "710c42c2bdc6fbdd85d653aebd4fa66079469cf9", "object_relation": "sha1", "Tag": [ { "name": "CryptOne", "colour": "#62260A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772953067, "uuid": "d884416f-fd3d-4a62-be23-e79fa90ac98b", "comment": "Malware payload (CryptOne)", "value": "44c6a207adcf423a56499379150843ecba07f6c7db7c2991f8ff2b0f630af1e750f79a3d76d420b63f83e25c2ba4cd7b", "object_relation": "sha3-384", "Tag": [ { "name": "CryptOne", "colour": "#62260A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772953067, "uuid": "2eecf093-d1d7-4f99-8d62-1925fd389e97", "value": "T1BC86E0031E9693EEC406B9781FD7C22C6477953128E8E9F9B473A9C6DE2311329F8D19", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772953067, "uuid": "4ca6d7c0-16d3-4dcf-8464-268b175bf011", "value": "e8450cd9fde12fe86ba788a327b66219", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772953067, "uuid": "08b626a0-9e2e-4896-a227-6dc1bdd24fc2", "value": "98304:nxJUL5k9ENQP9SIwX1CJQ18mPN0ar3rLag3Erp:x6dk6gSzwiWbar3/yp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772953067, "uuid": "5a8ba9c4-2c0c-435a-ae7b-f86d652cf5a1", "value": 8167936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772953067, "uuid": "96615056-6146-4c69-8bf0-5e2e0a71e37a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772953067, "uuid": "b09918f5-9a69-4330-872d-adb8a00f61c6", "value": "2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5949fbc7-1b43-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773011149, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773011149, "uuid": "bc42ea1b-0106-4c9c-82ee-79313dda36e8", "comment": "Malware payload", "value": "144eb49308dc229d236b303a87689978", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773011149, "uuid": "dc41c0dc-ae13-4c8c-872e-2341f510a531", "comment": "Malware payload", "value": "fde65dbbc392798341a9dc90d0ae58a2d50dc6e5e6170fae4ae29d6b80230f27", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773011149, "uuid": "ee5f3765-7d74-4641-a0fa-67d2a08553b4", "comment": "Malware payload", "value": "db06f70c7ab6e7edd973847e2e856d3c88447862", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773011149, "uuid": "59989f66-8378-4696-84d2-bfeb66435a9f", "comment": "Malware payload", "value": "6bb35e3b432f2ff4ed1126c955f3bd5793fdf9c2133169d2aef3f7bbf82adbb06a6e6dc85975f4afd3904baaffedd639", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773011149, "uuid": "61a2686a-ba72-424a-83e7-7a6496bdd477", "value": "T1C9D623ED80A522E4D8C30AC0768A43CE75D0655E45EDAC2D3BDB2D026F21D6F624DEB7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773011149, "uuid": "3046ed26-bdb0-4809-8f76-766411b54974", "value": "761a7e77c46c163e075c1c76d728ed81", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773011149, "uuid": "f770b8f7-e860-43bd-96c8-768f7b3452eb", "value": "393216:beid0i9vluxuVctPa7CaQ7V814heCcI065nEl:beiqevluxuetPas47l0nA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773011149, "uuid": "1b9cc89c-0d48-4088-b522-d2273688911d", "value": 13810104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773011149, "uuid": "42299423-52d6-44fd-9c06-56e36cf0e737", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773011149, "uuid": "9a58c0c2-3172-4292-b460-dc81aae86024", "value": "Fortnite.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }