{ "Event": { "published": true, "date": "2024-03-09", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2024-03-09", "timestamp": 1710028982, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "44b3abae-f937-44f3-bd5b-b84e453b8e38", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce4a1120-ddf1-11ee-b7ea-42010a9c0006", "comment": "Malware payload (GuLoader)", "timestamp": 1709974111, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709974111, "uuid": "0c5c927e-18e1-40a8-b2d9-a705bf05c892", "comment": "Malware payload (GuLoader)", "value": "dc5a44ef4eb172240cdc8caf46c3b914", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709974111, "uuid": "870c71b7-9dba-4f8e-a338-e768ac06c3c5", "comment": "Malware payload (GuLoader)", "value": "02287bb15e2cdc4638209d969bd8b88693e47c6fa30fddb6039adaf649bfb4ad", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709974111, "uuid": "d18f95a6-e5ac-404f-a3cb-379585ddeba9", "comment": "Malware payload (GuLoader)", "value": "e547ee256a1f4617959b1f1d0f7119b67d673793", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709974111, "uuid": "598bc989-44ae-41cb-9711-1bc16d90bfc7", "comment": "Malware payload (GuLoader)", "value": "429832cbade2b68dfa6e453b2268537427b161f7774b812cf18383c88ae9f6c9cea3bb1c8c8dc5cba4f70fc0b383e6b6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709974111, "uuid": "a9ab526e-70ee-4c52-aac0-5ccb10a5321d", "value": "T122D4F14EB6429895EF2101378597AEB59F0F7E38B5C2877253B077B919332858F3E209", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709974111, "uuid": "011664be-cfad-49ca-8437-135c9fe42d56", "value": "e2a592076b17ef8bfb48b7e03965a3fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709974111, "uuid": "ef603f44-8109-4154-9bc3-1431051204af", "value": "12288:M4mjiqrwQ5hiqPwKfCs0mduQmhbefpMCTLwAQz5UTN9ELRVOwPwilZMc/3:sTfuqPw8CsTmReh3FQ1C6LRVOHilZMcv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709974111, "uuid": "487bb2f7-0576-4faa-8be1-d7f080386a06", "value": 629536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709974111, "uuid": "06e441cb-50f3-4233-9ad1-53c3a5a2d990", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709974111, "uuid": "e75f8f2d-9214-4c27-ba16-647cdc64f2b6", "value": "Yolk.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0c56652-dde5-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709969015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709969015, "uuid": "3ec8fdd4-bb71-4f28-8840-ae64f7e802ea", "comment": "Malware payload", "value": "3252d959c0934a7264516a059750cb51", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709969015, "uuid": "274e485d-0647-41e4-99b1-3f58d1b793e7", "comment": "Malware payload", "value": "02bfb72bf1ce0aa2b26a0c600ed4c535973e16c37b8c3880e1288ff0629f6efe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709969015, "uuid": "2d58b3dd-f261-4987-aef7-d94206a7a191", "comment": "Malware payload", "value": "7a4863ae2b3efea09610cc8afef137209ed8e923", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709969015, "uuid": "0951ad68-1c0b-4e7f-bcfe-4aa4c0b3a950", "comment": "Malware payload", "value": "e315a7ad4f5bf6dc5a132bac8355064f7cdfdd200e60adf3396c4a8d1795fc6958fe8bcfe6161ff4d21b97381dc9f4f6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709969015, "uuid": "4116375a-a103-4364-8006-d22536aa8163", "value": "T14CE32A57A3A510ACE5B7E2B89A750612E7B27C550734D3CF0360813A0F67BD1AE3EB61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709969015, "uuid": "deb89302-8884-4adc-bd85-0bf70eef5610", "value": "2f7ae5cf50f80f4cf6e0d858b17bed85", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709969015, "uuid": "26f1e2be-8c7a-448f-89a1-6611c7db3107", "value": "3072:8nIIk+R5Lhd5awM6IZ6HSL39rdmJTQSaMm5/6vLNKI:8nbkC5Lf5atLtqWlwK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709969015, "uuid": "5591155f-31e9-4661-a98c-932d9ba1f6a2", "value": 143360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709969015, "uuid": "a40cbe01-20ec-4e88-93b0-c7749997253d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709969015, "uuid": "ccfdaba3-f90b-4a7c-9d19-d68d06c364bb", "value": "SecuriteInfo.com.Win64.HacktoolX-gen.19051.29558", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7851d6b-de37-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1710004218, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710004218, "uuid": "3853cdf9-4471-4232-812a-b53153b966b1", "comment": "Malware payload (Mirai)", "value": "47a60930f54f42cc0bc9cf780e1b29c0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710004218, "uuid": "6a2eae06-4feb-4e0a-b365-302eb6a7f7e3", "comment": "Malware payload (Mirai)", "value": "03b48df17ca79c116dd5cf0cc5baf215d87cb5d069fc575fb9f554a186b25460", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710004218, "uuid": "fb494325-265f-4c38-b670-61aae321dcae", "comment": "Malware payload (Mirai)", "value": "9d25c6453a451a75d29ed49dc60d5a66f3a607d5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710004218, "uuid": "840d0059-1140-40a0-94a2-242423c52df7", "comment": "Malware payload (Mirai)", "value": "679097bc9d4b90ee22288457d0322a432f726e7e17f889f28000ef28363bb375c08520fc5b985a9ec9bc86917b819fb0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710004218, "uuid": "78e49a47-278f-4a21-b4d5-ce7a880de604", "value": "T190535921797A2F17C4E9A07A25B38325B6B5768E32B8C65D3C732F4EFF14640A0075B6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710004218, "uuid": "0116ffe6-387f-409b-a141-72f1225d3e7c", "value": "1536:k+YY8/acYmgBOwicSYmnWLI1fz/A0Lzp6pdYm+K:n2DZYmnFxoYpgr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710004218, "uuid": "11b19b11-a7ce-4f22-bd03-c6503aa5d892", "value": 64400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710004218, "uuid": "85bdd447-2f71-4177-9912-13589bb4f6e5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710004218, "uuid": "a535640f-2a63-46ef-9a3b-bbc1ed63a77f", "value": "47a60930f54f42cc0bc9cf780e1b29c0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80b2e3e8-ddfd-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1709979135, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709979135, "uuid": "195900fa-4542-4c10-a3cf-586d2b38f10c", "comment": "Malware payload (Mirai)", "value": "03e7d6e5e1e09c5b101199ce355f1f7c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709979135, "uuid": "e49463a1-a664-4441-9e7e-9e7873979141", "comment": "Malware payload (Mirai)", "value": "0432d77fcbc90baa73074307c4d6342de8c7e72937039a5f974e9692cc6ab03a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709979135, "uuid": "d4215262-f57c-441d-b334-671bbd581534", "comment": "Malware payload (Mirai)", "value": "b1a7fba831b52b54d9f59c8738fc0f376bccda84", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709979135, "uuid": "5087ea7f-f927-4026-94f5-7215f0298b7a", "comment": "Malware payload (Mirai)", "value": "a74b0f69222ba6a6310ff207e9c07ea26c0becaa11b315eedbf74304533839571b4984efb58ce7fff2f06367f235d4e3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709979135, "uuid": "b53b611d-c72c-4788-b43e-3ef86c7160a0", "value": "T181C32B2B3B271E23C0C9547102E31331BAB9CB6938B953D7F9D06D9C2F26A943456BD9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709979135, "uuid": "f6af7d8b-b9cd-4b94-8398-4178cb9919e1", "value": "1536:yEsksTuVY80FkbkgcQBkrBN95rxtgKR83tcyphak2yEmsEt9/skYEP/UDjSQrD/R:nFgrBNProKyphak2Mr9/nYEP/UnSQf/R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709979135, "uuid": "baadbbd0-5d70-4b17-98d3-7ac6fbc72912", "value": 126937, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709979135, "uuid": "ff4259fe-63ab-432c-b04f-24b014400988", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709979135, "uuid": "2495e137-b3df-4c8a-9fc8-108301f7bf7d", "value": "03e7d6e5e1e09c5b101199ce355f1f7c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e17fcd9c-de37-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1710004208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710004208, "uuid": "da31b2b7-da7d-428c-a278-72fb11f01ac3", "comment": "Malware payload (Mirai)", "value": "053adf40dd653d2a02d20b18b778e65c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710004208, "uuid": "faa43c56-ed00-468b-8eec-396ed24a60d1", "comment": "Malware payload (Mirai)", "value": "065b3174f6eb7d10dd0fc06d584f8d37981901ce5b0fcf5c8de502039a3efe87", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710004208, "uuid": "21f46562-9ac4-4b3e-aa9d-b357ea760164", "comment": "Malware payload (Mirai)", "value": "5fb71405ea2b5d40491a511792b1d16e57ca4d0e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710004208, "uuid": "ed7e204e-85ac-4dba-bd8b-a69c01e09125", "comment": "Malware payload (Mirai)", "value": "2fb0c792f357cd6a2015006c0a164af22db3b1874074d54593db25ba070b959954d23582eea17ad68715528898cee483", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710004208, "uuid": "7b73887b-296d-4c60-937e-48ebb4a65992", "value": "T1F8A3C81E6E219FBDF769833007B74A21A79833D637E1D685E19CD6001E6078E641FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710004208, "uuid": "9f74de8a-d5e8-4c37-9e46-fc3d320faf1a", "value": "1536:F7EnxX/ZpiIvAuZrOV4pUEW5iIO24eFyZNI4oSioQ5:KnxX//iwqEWAIO2ok47o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710004208, "uuid": "32e96f9a-df57-4b58-a4f0-3772ff0f1608", "value": 98356, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710004208, "uuid": "967fc741-2687-47f3-8683-70322d0f11cb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710004208, "uuid": "06d5ee75-47a0-4dda-aee2-f6f55bdd1800", "value": "053adf40dd653d2a02d20b18b778e65c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5be3f0bd-de36-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1710003554, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710003554, "uuid": "ac5130a4-d76b-427b-9cb2-f771921800e0", "comment": "Malware payload (Mirai)", "value": "e4082a4e34328e27d72035be9acbb2d0", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "Moobot", "colour": "#FCD400", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710003554, "uuid": "8458745c-f4fb-447f-ad60-fe856bfdb278", "comment": "Malware payload (Mirai)", "value": "0898b420f584f9c3523f83131c6c0a8342272931bab93bb3fc81d9f3afbe5459", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "Moobot", "colour": "#FCD400", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710003554, "uuid": "937401c9-2429-4d0f-9887-c639f22bb6f1", "comment": "Malware payload (Mirai)", "value": "2edea708e623e67790eb7adf1ee3e2662693b841", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "Moobot", "colour": "#FCD400", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710003554, "uuid": "04cf6ae6-6e2a-406d-b2a8-964a63453d8d", "comment": "Malware payload (Mirai)", "value": "1f74cfc69da87d62477a5ff080763022c022e892c5cb9282f44e267953403ed9b3d29a63c5c79513376b8b2f60ee1bff", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "Moobot", "colour": "#FCD400", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710003554, "uuid": "88b13b91-990b-4138-b85a-7f4fb54afb67", "value": "T168042A46EB404B13C0D627B5FADF42453323AB5497EB73069628AFF43F8679E4E22905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710003554, "uuid": "19ea57cb-5bc5-4073-950d-db82318545f0", "value": "3072:EZHZ9pjx3vAqTkgabsh+OcAIeLHSwBjLq2cJsoyM/Rs+qtK:EZ5vx39ogabsh+nAFlBvq2+xyM/R7qK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710003554, "uuid": "c8b8e4cb-942f-48e1-9b34-d8840a823327", "value": 179803, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710003554, "uuid": "1405a970-1544-4602-8234-ee11ff56f56d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710003554, "uuid": "17de1c8a-d48d-45b8-ac19-bf18c56e319f", "value": "vlxx.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9ba9bf8-de31-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1710001591, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710001591, "uuid": "aacb104a-a7da-4062-94c1-5f9f1ef96907", "comment": "Malware payload", "value": "5f876b340b56f98e820816ec05e56d34", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710001591, "uuid": "782f4d03-8440-44c3-9202-37964c5e60cd", "comment": "Malware payload", "value": "08cf4a012c0aab62dc068e7a20fd1582f215f927c4185481da60ada9b636d282", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710001591, "uuid": "619b1fec-f6fd-413f-88a8-08cf4d326050", "comment": "Malware payload", "value": "3bcdb73f1672e21776cf0ce0c96c8d5496f91586", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710001591, "uuid": "41b296fe-4213-47c3-9892-3bf92c74db0d", "comment": "Malware payload", "value": "48e1005f7d43f0f4f144e3e19209755e86537a665196c878f815b60754764d91bd425b865370211cdd1d53017e9a543c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710001591, "uuid": "3c0f9e21-93fb-489f-a7d9-5634967202ea", "value": "T14BF533A72620BF2BEDDFC576C05CBED76863AD7C8488086A0D1482C35D7629F3AD911D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710001591, "uuid": "f77373e6-f0f5-40e5-af2d-8967b94eca19", "value": "4abc07866f054726aa41acc7ea4a0bc2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710001591, "uuid": "eec96aff-2d44-4d43-89a1-96e6510b5916", "value": "49152:kKtU2HL/scLu2asJ5RGCBF1hdgKtS5jwiCmNAlNsYmYmWA5IxfRU2Sph0afojHBX:BtqfsrgqSKA5jJCuAluvWA6fUD+0oB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710001591, "uuid": "a6fe3af7-86c2-4e9d-9276-6463137feac8", "value": 3447316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710001591, "uuid": "75e6e5b8-2dad-4210-ab75-c913cb299285", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710001591, "uuid": "07d1af57-f79f-4dbd-ae12-2a80e5f908fd", "value": "SecuriteInfo.com.Trojan.Siggen21.18326.8878.16572", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7645224-ddf1-11ee-b7ea-42010a9c0006", "comment": "Malware payload (GuLoader)", "timestamp": 1709974099, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709974099, "uuid": "b19445cc-13c9-4c4d-855d-33c07aff05b9", "comment": "Malware payload (GuLoader)", "value": "ac6400e4bd95cdf3b3029324b61a214f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709974099, "uuid": "4014b323-196b-4493-9645-b939c7db4698", "comment": "Malware payload (GuLoader)", "value": "08e7fa1211fbd201f35d5ad417a458a6ce8e72982c0f6a091e20ba1d6a96041a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709974099, "uuid": "99e37ca3-c229-4576-a2a1-b2fd8134cc5d", "comment": "Malware payload (GuLoader)", "value": "66e54775f739d6fe2f7716331183b9d2147d1f3e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709974099, "uuid": "3e7b0c3e-efee-439f-a335-3c378f66706a", "comment": "Malware payload (GuLoader)", "value": "b24884259a27dab59df0c43d01405b8d20f8440b20128cb072317db0fb330484d4eb7fcb878908d57747fafa8980f043", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709974099, "uuid": "5ee68f45-d186-46cd-bee1-b646aa892e19", "value": "T172C4F14EA55294A6EF20023B8597AE789F1FBE38B1C54732137037B81C32695DF7E219", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709974099, "uuid": "f7bb41ac-6c90-4dde-880b-3109665305ab", "value": "e2a592076b17ef8bfb48b7e03965a3fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709974099, "uuid": "c3036cf6-8c29-4794-ac66-88ebb8872ca4", "value": "12288:x4mjiqrwQmFDP9ppP/Hi8MP+KjE9ELRVOw7CekMc/m:xTfmFDPhP/HM+EE6LRVOckMc+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709974099, "uuid": "c5da54aa-9b6d-4181-bd8a-3126f20c0950", "value": 584008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709974099, "uuid": "ae1ee9cf-e17b-4b68-ba40-add77af0ba7c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709974099, "uuid": "675d36c4-96ad-4e84-bb01-8c396c99377f", "value": "Condensers.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae9c779b-de37-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1710004122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710004122, "uuid": "a4c965ba-82ef-40f7-8e9d-ee312c957360", "comment": "Malware payload (Mirai)", "value": "8f4daf912ae5b22ec0b76b0ac72da1ed", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710004122, "uuid": "727b7a6b-cb52-43c9-99ec-ea907316be5d", "comment": "Malware payload (Mirai)", "value": "096c2df549a027b389ad3ba904847716104f1e3560031fd96c8af397737b7f57", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710004122, "uuid": "2c1113f2-450b-42e2-9758-3a491916f502", "comment": "Malware payload (Mirai)", "value": "1769a6815cb7caab7b98f6fe173517ef9ae87b03", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710004122, "uuid": "4e41a661-fdf8-4fd1-a0d7-37f94f1e3a5f", "comment": "Malware payload (Mirai)", "value": "4c8b8150846fb0407d90af639e91f88cd990dc267a44cfa02074de09ac970763327c2b334e71145df1740518fab4b556", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710004122, "uuid": "78f94659-b5df-43c9-a9bc-33ec10baca26", "value": "T184839316BF601FF7EC9ACC338AA91705289D611E31A93B75B830D428F25B25F15E39B0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710004122, "uuid": "c7ced3c5-a7c2-4203-99f4-8831bb81241f", "value": "1536:bw4pjQLOQ2GTZHslkJGAopJpPok9Z5ztydd42+B:bw4pjWQAFslok92", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710004122, "uuid": "c0fb5e0f-8704-4be7-9636-2d521792b0a5", "value": 84172, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710004122, "uuid": "113aa66e-3606-4215-8a96-99c6de529d5b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710004122, "uuid": "6a9d255b-bbfc-4e8c-87f5-7d8e63de438c", "value": "8f4daf912ae5b22ec0b76b0ac72da1ed", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6307687-de08-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709984002, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709984002, "uuid": "074e4f91-a58d-443b-a003-26d317285d09", "comment": "Malware payload", "value": "9336e7c166a98974491ff6bfdc72a724", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709984002, "uuid": "86c7122f-6d40-462e-9d4a-f86732af63e9", "comment": "Malware payload", "value": "09f6c5f671258784a9da80981b43445c27599f84a69fda1164caeb0d0f9e58e5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709984002, "uuid": "f7b85594-0311-4c62-af88-3476b60fbea0", "comment": "Malware payload", "value": "22e1bd229fcf7475dd6d852ba033866f2450afa0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709984002, "uuid": "7df79e5b-6e88-4dc7-9039-9c9f50192a5f", "comment": "Malware payload", "value": "1f60ad84ddc6409f69b5beff78dc6a26f25d7fe830b8a41e2307a559477e2f6ee7982a465d8683ee008e940041fc645c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709984002, "uuid": "11fa48d1-8d07-4f4f-9b40-43d139b23010", "value": "T1F562C94BA30C5B33F9CDB67C4C4B1762FC31D862C70181972AA7D56D8E873D6AA02B65", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709984002, "uuid": "c07896c3-1019-4409-968d-75c074875a71", "value": "384:Qx3fpiATUnsU4pYL5DEg0eMSkhKcjK0+rIgXD:QxvpVUnsU4pYL5Dx0eMSkgc20qIE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709984002, "uuid": "75534a72-de36-4367-b35d-7167918b8452", "value": 14752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709984002, "uuid": "52899192-01e3-4e7b-b76d-5f840ab9784f", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709984002, "uuid": "7af4293a-dbf6-4ee1-a67c-9f71491944ef", "value": "SecuriteInfo.com.Trojan-Spy.AndroidOS.Banker.30539.17625", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "591f0e29-de36-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1710003549, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710003549, "uuid": "9381a0e3-ca59-41ca-934e-323d574228ab", "comment": "Malware payload (Mirai)", "value": "1ed6dc7ed88b1b303463f00cc6e4faa7", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "Moobot", "colour": "#FCD400", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710003549, "uuid": "34d64e3d-9596-4abd-b5e7-a6014d62a5db", "comment": "Malware payload (Mirai)", "value": "0aca3c79e75557bd26a7f06e21918cb38ad3370deac5a2f7bd7da20512ff3f17", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "Moobot", "colour": "#FCD400", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710003549, "uuid": "67d7ece0-eddf-4710-95fe-6131d125e95d", "comment": "Malware payload (Mirai)", "value": "80ea88ca51f5271fc9f4fbc31c3b016f270b6a3d", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "Moobot", "colour": "#FCD400", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710003549, "uuid": "b850442f-0692-4802-b9f2-f39e8fac9903", "comment": "Malware payload (Mirai)", "value": "549def25643839e2de0140fe956b0ad52a48d49380c981c3160a752662d84763ddfb9ce2b39f9accf134a723e5987bea", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "Moobot", "colour": "#FCD400", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710003549, "uuid": "bddd4b90-adee-4de8-aa0d-e29b3c007076", "value": "T18D04FA1AAB510FBBDCAFDD3706E90B1139CCA54722A93B363678D524F50B50B49E3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710003549, "uuid": "3891712c-877a-4777-b77d-c101ba392c34", "value": "3072:uCQDElnTrhX5MZ6vKOgwRl6adAbVNjeK/iy8:uCQQRnhaZ6vFg+ljmLiK/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710003549, "uuid": "1310b2d6-7a2f-44a7-93da-859aa6fde7c3", "value": 177856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710003549, "uuid": "c8de1bf9-288c-47a2-a919-bc27a55855eb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710003549, "uuid": "03b9d108-c151-4135-9671-97cd2e63b9f8", "value": "vlxx.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfcbd0ef-ddfc-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1709978811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709978811, "uuid": "08906c5e-79fa-4a92-bb76-5a7930ca7c83", "comment": "Malware payload (Mirai)", "value": "ff0db6af8aed188511330266f5319b87", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709978811, "uuid": "8c6a85a7-d0d7-4f9a-9b33-16bc5c831ba8", "comment": "Malware payload (Mirai)", "value": "0b1634a58da7782fe4dd8e42ab5c8dcb4a4db28aa50f9467550c45847a8f03eb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709978811, "uuid": "a1e9b1dd-5aed-4a2b-8ae9-550493d09f7a", "comment": "Malware payload (Mirai)", "value": "ad63eb16a7acf84023e3a0573ca2bec97ce9a8c1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709978811, "uuid": "71d7123d-001e-4fc0-9d1f-dadc9ca73aee", "comment": "Malware payload (Mirai)", "value": "499659b0d6d49810b9e9eaca2d137ed92fabc1e92f09e319a33963939626d0fb601dfdd32a520f4a57735361322e57e7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709978811, "uuid": "03f443c2-e5cd-43be-b37c-d424069de168", "value": "T1E404881E6E228F7DF66D873047B78E259B5823DA27E1D640E1ACC1105F6039E641FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709978811, "uuid": "3e169b3f-9675-484f-b20f-83ecb11a2e3d", "value": "1536:T16zePrQiQY3hY05Y9vt6Sw6cFL+z14R7oOe/3LM76qfTOSV2dLi6jyfjydN:TnPvQG46SKFahy7ox3LIS4OLnyfjydN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709978811, "uuid": "4e4065bb-bd58-44f8-aa3d-a799f38e6c0f", "value": 173824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709978811, "uuid": "6a8ea601-706b-45df-8023-80f5f476b4e6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709978811, "uuid": "68a07d17-8f23-45be-9597-e3693420d86d", "value": "ff0db6af8aed188511330266f5319b87", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e5d8960-de06-11ee-b7ea-42010a9c0006", "comment": "Malware payload (PureLogStealer)", "timestamp": 1709982969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709982969, "uuid": "74eef2f4-fc1c-4a1e-88de-963b94c325d9", "comment": "Malware payload (PureLogStealer)", "value": "9896236c006d8624dd73f39a9c7dd30e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709982969, "uuid": "c77b6f50-988e-4b95-9b79-84ec5d50a85a", "comment": "Malware payload (PureLogStealer)", "value": "0bb9785c91f79bc5ef015028e5b716d21b0ca2992a545dcfb68e544fd70737b2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709982969, "uuid": "e2e3788e-ab72-4dc7-9d9a-e8450b224d20", "comment": "Malware payload (PureLogStealer)", "value": "0f4cbfc0d335b5ee26062354719745feb407a0fc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709982969, "uuid": "317c4ce4-4d5c-4aa4-b5d9-4b24cb20dec0", "comment": "Malware payload (PureLogStealer)", "value": "5ecc809b44c96341d4f162157b4c8e843e43e0843f5c1835782cee8075c0bed8e8e0d2bd0a9030444352c6f22a5091dc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709982969, "uuid": "cefa5791-3a14-4efb-beb9-a1443134098a", "value": "T16CB523AB576BE6AFDBEC0BB890514602A3FC898AC750F71559A900E41D16381FE5333F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709982969, "uuid": "277942ef-97b6-4205-93f4-8640be17492b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709982969, "uuid": "23c8704b-b63c-4142-a773-e7635fd012f8", "value": "49152://Fwb74gsnn4yIHz7/SSefPzl/F2egInzT7sV9Pvc:/dwb7By4THufBt2ptlk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709982969, "uuid": "43c2fbc3-9263-41d1-9be2-3df0b4ba0175", "value": 2433672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709982969, "uuid": "71520ade-ad8d-488a-9537-5c998c18431c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709982969, "uuid": "0780065b-731e-4ae8-8e2c-abc0e1403b12", "value": "9896236c006d8624dd73f39a9c7dd30e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f547bc66-de37-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1710004241, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710004241, "uuid": "9ae59d91-7a56-4341-834a-cb0256789cb5", "comment": "Malware payload (Mirai)", "value": "cf08523ed48d598e6274875fc9764059", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710004241, "uuid": "8dfd637d-0513-4dc1-9a13-c160758db545", "comment": "Malware payload (Mirai)", "value": "0bdabafba60953c461c76f83f8a27b6481041cb38081c7c2f8c461f9796eaea4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710004241, "uuid": "3fec0a4c-be6c-454c-aea7-c719e37c1283", "comment": "Malware payload (Mirai)", "value": "69d231b96ffc03b4a2db9bb6f5ea0e014e06d2f4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710004241, "uuid": "3a233644-a95a-4790-90c3-038258c42705", "comment": "Malware payload (Mirai)", "value": "088f0fa6020c66f99265eebaaf04d629738df0ec52a50525647ac8bf0bec93de6da28a38f4f921aca8d724a76bf18660", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710004241, "uuid": "7314c062-4870-4ad8-b2ce-231d8ee53756", "value": "T196434BC5D563D9F8EC1526353077EB725676E93F1028EAC7D798A932A982A03D80328D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710004241, "uuid": "1f6f5e04-ee53-4e9a-8aa9-470c066dd9f8", "value": "1536:U8mUGKqpe/T21LrHgpTzVR7WyjZVZNexcZ:UoGppe/TczgJVR7WIZVZwq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710004241, "uuid": "4462faab-8251-4163-9dde-f37076cf4929", "value": 55840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710004241, "uuid": "99ade7c9-0142-4836-9ece-05df861d5c4a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710004241, "uuid": "25510bf0-c0cb-435f-884f-46e2353647ee", "value": "cf08523ed48d598e6274875fc9764059", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44dcd0d0-ddda-11ee-b7ea-42010a9c0006", "comment": "Malware payload (PureLogStealer)", "timestamp": 1709964002, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709964002, "uuid": "dc79bc62-5084-4b2c-ba98-7ee9e926545a", "comment": "Malware payload (PureLogStealer)", "value": "2b648280f8c5e94477ba7521982c0375", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709964002, "uuid": "83e69e00-77d7-4517-bfc7-ff0dd6dcb24c", "comment": "Malware payload (PureLogStealer)", "value": "0c3419ff8ddebff25027285ff876f30569e7915b993930411b230cfbf3e52214", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709964002, "uuid": "7d265d85-e25f-4e22-87a8-a5ae7dd37730", "comment": "Malware payload (PureLogStealer)", "value": "c7d31fd2ae975ae8f409f47dfb044e3972e548c0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709964002, "uuid": "a8733de5-b22a-47d7-8502-a16ea142ce72", "comment": "Malware payload (PureLogStealer)", "value": "4ed68960fe6f53871b9f0b54d0ef48a12702bf05d823ea188de29894168b9747a540da0c283342789ba0234cd0d4e1a0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709964002, "uuid": "2683a667-80a2-4947-8e1b-1c3b4679b84a", "value": "T1C485125441AFC633C69C5BB4F052E60567FA038BB042FB0EB4AD12D35A173E2E74666B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709964002, "uuid": "8558fbe1-0228-421f-a92d-5775a8aee8d3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709964002, "uuid": "9fd9e02e-7b32-4b0d-b700-d0979dfcc009", "value": "49152:ZKGnCj/YmUwgqk5QDop30BEwddWhxzvFRtDKa4pW0OVxUITbBZ:ZvCs7qEP3WMDKvpW7TdZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709964002, "uuid": "f20d8759-42d7-47ef-9125-66ab2fba8474", "value": 1807496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709964002, "uuid": "a5183b34-aad2-4364-abc4-c82bf7c86612", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709964002, "uuid": "7ac43d63-44ab-4995-8157-df94758477a5", "value": "2b648280f8c5e94477ba7521982c0375", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2f51a15-de19-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709991352, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709991352, "uuid": "b96e64a6-a501-471d-93f7-09d1e6e8bb2a", "comment": "Malware payload", "value": "89d84edb83d55254e357cd71dec9b1bb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709991352, "uuid": "e2070877-15cf-4d7d-83b6-9046b6886c85", "comment": "Malware payload", "value": "0c4ad6ee19e6cedad99b2973787bed78fc4a10e94010988f681d3cbea9bb8f98", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709991352, "uuid": "2f2314ca-a649-4aa7-92b3-0cd214fdcaa4", "comment": "Malware payload", "value": "0478e6141e442db524901930a2bcb591db2acf1f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709991352, "uuid": "2af15665-1752-4a20-8704-b711c03eec83", "comment": "Malware payload", "value": "fbd7e611ecf816d7474b7c9b5ccb03ec5ed7ee80d84b01d42995a2568a607bd7d48b893087bf1856115f5d8856a75a23", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709991352, "uuid": "fecfa1a8-ba5e-4ea2-a470-565b8d3d4e04", "value": "T103C2E1CD2DCABD30E2665D73786559634571CF8B5E13C0FA86BC0CEEA29D1881BE811D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709991352, "uuid": "b4824d2b-eadf-437f-89f5-f473c54352ba", "value": "384:RQfDVIcfnDNdCMJc/aH73Q8GaorAAfm4bs5ZX1bNBl9sgicCdg1QTwgL2VRqt3A5:RQbffDNIPu3QAsm8cZH1CdgLO2VRqG5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709991352, "uuid": "c62b05e6-7858-4893-8bb6-b7dc6f4ec75f", "value": 26754, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709991352, "uuid": "c5ee4013-bd41-4380-8c67-7d81c71f6e6f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709991352, "uuid": "7e98d90a-45d4-4e71-b4c0-f2d6ff372e59", "value": "SecuriteInfo.com.ELF.Svirtu-AA.3249.29604", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90ec8da2-ddcd-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Stealc)", "timestamp": 1709958546, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709958546, "uuid": "e039bb70-159c-4b22-b424-f86b3aa1744b", "comment": "Malware payload (Stealc)", "value": "ac23c01bf66749720ff358853ce5f028", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709958546, "uuid": "096ef961-740d-4c16-882b-ada439c66b4f", "comment": "Malware payload (Stealc)", "value": "0cad0646a8a1f925eef0a0de3aa3a090458fb76850b14347894489b489ffb3f5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709958546, "uuid": "c5c47aeb-9016-4545-8894-0b388c730a94", "comment": "Malware payload (Stealc)", "value": "ee0571e7da19833b8ca28f686184ea8adc7f1551", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709958546, "uuid": "11df649b-c291-4229-be72-644d326fa1cc", "comment": "Malware payload (Stealc)", "value": "977cefa2410fc34af462ac4ee30e4ccacea7c70927e84cb3ca91d0bd51102b2a2fa2d11d8442762fab25b6fdccabc3f3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709958546, "uuid": "6a39eedd-958e-47bc-a385-4f7bd0403451", "value": "T17164F12132F4C436F8B3563448B887A4A97FB8176A30418E5BA4267E1F713D18E767B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709958546, "uuid": "982208ac-fa11-4095-b8a4-839a546108a2", "value": "35c41750c1a74adb13b620b0ac1254bc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709958546, "uuid": "e3fe0673-fb8b-46c2-b481-33047396018d", "value": "6144:NzTYZKpMne8SSgWyqkESJ2Wyi6NFyg5ShfvDFkoYmD9LRb6:RGEMnRCDJmzNFyhn7Rh6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709958546, "uuid": "a15efe27-e884-490a-9915-9d42873c9bf9", "value": 320000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709958546, "uuid": "ad6e5e30-1efd-418f-a233-a9f4c98babd7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709958546, "uuid": "8864e3ce-2b86-4965-b3ea-6d464ccbf16f", "value": "ac23c01bf66749720ff358853ce5f028", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40a61a94-ddda-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RedLineStealer)", "timestamp": 1709963995, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709963995, "uuid": "07f6e83c-a36f-4711-8eb0-0828e0ac365f", "comment": "Malware payload (RedLineStealer)", "value": "211c3659790c88b15827ec89ffa5898f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709963995, "uuid": "1a58dd81-29c5-48c1-a38a-6b81862aad75", "comment": "Malware payload (RedLineStealer)", "value": "0f2f61669d3bc852e0defe69777a70627ae072b167425a64f4c88ac9ca84389c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709963995, "uuid": "c9bb32df-83fa-499e-8b93-6721eb629073", "comment": "Malware payload (RedLineStealer)", "value": "f0ef5847fb9a1db37b3307e3b2b6f90098aa6e65", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709963995, "uuid": "2de18391-3df9-4c4b-9256-18dc99841a19", "comment": "Malware payload (RedLineStealer)", "value": "4474fa57cd6ad62baf5b0723fb737b902797d1c59b8587ede5ab5859eb1817282ebfd609fae1d6e99fef470b2f792631", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709963995, "uuid": "0b10c9e3-faf9-4585-ae8f-0cfdd44278cd", "value": "T1068512BC86FB9B66E7DD46FC80D1090763FE4A8A9157F709608820F05C167CC9573AAB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709963995, "uuid": "2620d357-083a-469b-abdc-0b96ccffab83", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709963995, "uuid": "c54364ae-c55b-40c8-9293-48bb9e5b2d7a", "value": "24576:mnkh7MnClk+2SEETqUjuX5DYF5l53hDGlLVnHeV+6nn3kuoMryAF72btp/H:mn8kCKSEEA5DY/glLxHeV+6n38MHh2P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709963995, "uuid": "92d2d834-c2f3-463d-9592-39f3182225bc", "value": 1816576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709963995, "uuid": "11b93e6c-3a96-4dea-b50f-d3bd10a1e225", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709963995, "uuid": "53997353-6208-4462-9a2e-a9c9f50b7255", "value": "211c3659790c88b15827ec89ffa5898f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd53d808-de39-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1710005033, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710005033, "uuid": "ff70fa35-2a95-40c2-a01b-f61d76290bbe", "comment": "Malware payload", "value": "16b2d0d6dbe9191d57531a0ab4582cbb", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710005033, "uuid": "63ff4509-8182-40be-84fd-246624234ba3", "comment": "Malware payload", "value": "1008354df0f600da2e57ba81e66b045807a2715296b1c0273eb2b0a4547263cf", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710005033, "uuid": "7ef0ff08-0914-4027-861d-f0794ee0e684", "comment": "Malware payload", "value": "c9de55b0cbd17f50bd6fe0405c4239f635fb3972", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710005033, "uuid": "9b742664-681f-42f6-920e-7bc499f9b122", "comment": "Malware payload", "value": "58b3011ae68d23281da35230a92cec5d5da4747cf5c9cf6d0e28586e9857adc865b85a22f2b604978f487bc239c3d012", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710005033, "uuid": "3d9880a1-0c52-4c84-a630-838eabd427a0", "value": "T104564B84FA83C1FAFD1729B0A18BF76F0B35A2018631DFF6D914284DFD23A921519799", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710005033, "uuid": "b5c210d2-aa7f-4069-a755-995a390e161c", "value": "1c013b4235c1c0b81c1d0ad7f9417528", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710005033, "uuid": "618f3bb4-8f24-4624-a297-18a81329f59f", "value": "98304:uudoQn3jhE4Zxn5EduZwSWkG+UcZ1YeHqCkJUr2GprPrimm7wPRkjPlGPfJloOys:DoynyEMkGEZ1YeHqRfGprPrimm7wPRk8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710005033, "uuid": "916cfbb2-0fe3-4f85-9d61-6990dab2aaa5", "value": 6261760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710005033, "uuid": "0b358e46-18d3-48eb-9a70-4bfc4b98cdfa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710005033, "uuid": "bb218e0e-270b-43be-9f86-95e2284e45ec", "value": "SecuriteInfo.com.BScope.Exploit.Shellcode.5740.11303", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18efe6f9-dde3-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709967794, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709967794, "uuid": "646daab3-fb97-47c4-b359-72a6464747b5", "comment": "Malware payload", "value": "3e63f07d538f4e11dfb1e452c2530f0c", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709967794, "uuid": "5ebb0057-a45b-476b-843a-c9d4e0979373", "comment": "Malware payload", "value": "108f187a673697292c6c9d223825163cad6a52f11123bccba63ce49d1b2a0a60", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709967794, "uuid": "7e4f05cf-5311-40f1-8d71-c7a02be02994", "comment": "Malware payload", "value": "c4b0f76ee3a4f223e3cb32c2cab5b9ef95d87d70", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709967794, "uuid": "71ac9a89-f3da-4f37-b03f-262a38f6116e", "comment": "Malware payload", "value": "64b9c7f9783ffb793937b8d43ea19a1fa07b46e0fffbabf726ad922aea5d667e3b81f309d60948d81f533106de732c3b", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709967794, "uuid": "ede3c76a-8f8c-43ec-b5b8-3406707a7354", "value": "T11AF37D02B2C184B1E67B0A3915B4E2225F7E7D20CEA1CE5F63946A6D4FB85C0DD34E76", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709967794, "uuid": "2be3c252-d1b1-4e9f-afdf-ec2e15205c03", "value": "98fbadf1e6601a5d22be4fb72ed51056", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709967794, "uuid": "7fe60899-9732-4944-8fde-022869ddaed2", "value": "3072:de0HBrRJW9+tjZGsfzeV0YuNmu5uWj5OUq//euLcb6bD9+v:AqrRJGeMsry0hmuqjoWbD9u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709967794, "uuid": "c17fa764-a8c3-4a69-8a91-33c8bf95a6e6", "value": 169280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709967794, "uuid": "a2220f03-fc80-4d9a-840e-e3c6d3a71572", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709967794, "uuid": "69a2d501-2627-46d8-890e-f6af5576ace6", "value": "ptusredt.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbde191b-de38-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1710004628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710004628, "uuid": "c9b00e92-39a0-49e0-a96e-364583e6a222", "comment": "Malware payload (Mirai)", "value": "6b3d0484d2838cc0d2655770c7c37d33", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710004628, "uuid": "82515ed5-dc4d-40fb-bf75-e991fb62c4cb", "comment": "Malware payload (Mirai)", "value": "10bfe49af9ae29d91aab45981cb091e4dadb2e38271fca1c6ea56a468c5ccb2a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710004628, "uuid": "2e5fa9f4-a0b1-489b-b461-21a8359e0ffa", "comment": "Malware payload (Mirai)", "value": "7fc3d5afbb110f805b45b13d5964f423750c6c79", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710004628, "uuid": "3553a4bd-6799-4b5a-bd87-ec16fb9a3572", "comment": "Malware payload (Mirai)", "value": "5cd58515fe578d88588053b83b98f2d20d31a41a598b68550933b5429698e9ac230aa5be54c28de4a2fabb9bb1e7acf7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710004628, "uuid": "73bb3fad-de68-433f-867c-3d95c0831737", "value": "T100230752BC828A56C6E02376FA7E02DD3321A3A9D1DE7267DD105B1036C991F4D7BB82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710004628, "uuid": "2cdd71e0-7d6c-4241-b800-a4015ed2ca23", "value": "768:dbJLOaGBpxbmjQrgrqEVlwYrLOnsivG46QagHK617dz6o7UWRBNkElI:BZxAjmkrg7LOXvTFagHZZJ1P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710004628, "uuid": "61711544-ac26-47b9-8dd1-f7fe7580e3cb", "value": 46320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710004628, "uuid": "efa71115-8f4f-476b-b984-45efbe9de742", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710004628, "uuid": "abfa73dc-2275-4b6e-a309-a93f485d34b5", "value": "6b3d0484d2838cc0d2655770c7c37d33", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b989fb90-ddfc-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1709978800, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709978800, "uuid": "9ac0d1d4-95fa-4d90-8b78-592c7ea633ef", "comment": "Malware payload (Mirai)", "value": "a6b0088c27e5f1afbc9490a163802642", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709978800, "uuid": "f9f739a0-12e9-45bb-bea9-99f144744fb0", "comment": "Malware payload (Mirai)", "value": "121ae3a7c07b8c149a3fb8e8b3b961319523ff35c5af2baa93f51504efed0a42", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709978800, "uuid": "4b5c8836-e8c2-4260-8a27-02fd27b99ba9", "comment": "Malware payload (Mirai)", "value": "361856c7e3ac04eb808d5f1a03a6be8225ac6e0f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709978800, "uuid": "bf6b0f4a-21e9-478c-be70-4ed6dbbe8196", "comment": "Malware payload (Mirai)", "value": "59b3db854b6d79e9cc202d5cbdb2621cc11ac88b270e359743207fa58dd592a708451b98154930c68c34d869c01762aa", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709978800, "uuid": "eac68212-1e4b-4397-a9af-be126821e981", "value": "T11343026C54061D6789500679CDF147033ACFBF75A2FB75992F38E2D66BE28011AB0877", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709978800, "uuid": "ec7a4789-b3e5-4bd6-942d-8800c286f913", "value": "768:vWNbsc8HC6DnN8StVF+XLFghkps4D94iAl33+MZw/QJq3UIQHDmlnBIxoTGp3Pv:vGwcWzNPQLzpsG94J4QHKlnBoV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709978800, "uuid": "c5859b0e-4c47-49fc-9e65-35e1e7d5497a", "value": 58332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709978800, "uuid": "31d5700c-1ddb-4fd9-9217-f8026a1fdb96", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709978800, "uuid": "23918f4d-f7c5-400a-b6ae-215411e01cdb", "value": "a6b0088c27e5f1afbc9490a163802642", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d60f1ea5-ddf1-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1709974124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709974124, "uuid": "b4fb0296-b352-4b18-852d-cdb339d7303d", "comment": "Malware payload (Formbook)", "value": "bf02f48b765fdcaf5397db110370b00b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709974124, "uuid": "786319f2-8441-485e-8fc0-ee8ecd17ad3a", "comment": "Malware payload (Formbook)", "value": "1238b38b0209e4a39fcf15960916bc76a413fab1a25d24e8d37bdb9368da6f3f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709974124, "uuid": "5d8c8fcb-39f0-4a61-9d02-57e9c0961e1f", "comment": "Malware payload (Formbook)", "value": "b15e855a1bfe9f4332b2ab7e99e3030c46e72379", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709974124, "uuid": "6950a07d-1824-4b99-8093-738be3963be6", "comment": "Malware payload (Formbook)", "value": "7ec4dbc658496285cb2e7cc62aac207bab635e54cd20990f484913704262195cc4828626f4ee2ceae8352f763bfe9b61", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709974124, "uuid": "eb0938fc-762b-475b-b66e-eabe587e87c1", "value": "T191D4024EA14299A6EF6145378567AEB4DF1F7E3875C2873213703BB91C322958F3E209", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709974124, "uuid": "9f6bde41-b6e0-4a80-b18c-92220d1bf91a", "value": "e2a592076b17ef8bfb48b7e03965a3fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709974124, "uuid": "4b30564a-1ad2-49b9-914a-c4b9c216b7c7", "value": "12288:c4mjiqrwQmkDrp83ypMVNPisjgp9ELRVOwJrfaMc/J:8TfmiKxNPisEp6LRVOkaMch", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709974124, "uuid": "bd05aa01-c295-44e3-acc7-4b0e39483f79", "value": 614008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709974124, "uuid": "414cf842-abc6-4848-9a82-bd6552ed9699", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709974124, "uuid": "f493fbe3-a059-4754-ab39-309cc6a7b8e5", "value": "factura pendiente.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfde82b6-de37-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1710004151, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710004151, "uuid": "ab7918f8-fa2c-4a93-b57e-839de6984b2c", "comment": "Malware payload (Mirai)", "value": "5aec38aad5fc16bfa8e0558f97623db8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710004151, "uuid": "d5aac38b-38df-4fb7-87a6-de383d814071", "comment": "Malware payload (Mirai)", "value": "127d3f68ea8c52ea973414d546e8ce1ecb8f3473c0cf34986eb21cf4c18ffedb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710004151, "uuid": "eadd4448-9c0d-4a43-861e-5f4b033849ba", "comment": "Malware payload (Mirai)", "value": "7005b9ddda0a75afdd0544973d662882ecfe9fa5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710004151, "uuid": "94b77cb6-53e9-4d9d-8d64-0fb5a59739b9", "comment": "Malware payload (Mirai)", "value": "eb68a0df3d9a686405d6ea5735eefedabbaabf59df73a71db5a78b40ea43a934652a878b78f83aecd2fe00953fe26bef", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710004151, "uuid": "4b1ef1da-1f50-4c9e-8bc4-6469b5227b63", "value": "T14D73A9092E358F6CFB5D823697B78F219758339626E1C645E16CFE021E7024D341FBAA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710004151, "uuid": "b7b8d942-c84f-47f3-8396-868e5ddba467", "value": "1536:lo89L2T27mQaXcn6EyvXqaQSiIHW5VU+6Y3jfhdR2QEc8LMkdd42+T7w:lo+2TIaXIE6aZiIH0VU+6KfhdR2Hc8Lt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710004151, "uuid": "63016625-6250-4356-9877-5eadb6bbd3fb", "value": 80188, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710004151, "uuid": "0d6adadd-f364-4b59-bb13-f9f8e5257f2c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710004151, "uuid": "f33ce950-2715-40d1-ab20-b32d49ede1ea", "value": "5aec38aad5fc16bfa8e0558f97623db8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3153a64-dde5-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709969019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709969019, "uuid": "bb0383af-4f7f-4a73-99e8-82ef15ac6d2a", "comment": "Malware payload", "value": "41b3774565ac561aef45671c60579023", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709969019, "uuid": "a80b9473-3d6d-435f-8942-8af07fe22e5b", "comment": "Malware payload", "value": "133b98b44afad48637c16b6a7ac2f4a50326036dfd6a50781b5463010a271f8b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709969019, "uuid": "821ae38c-41d9-4918-ac21-a5b7bfd6f3d9", "comment": "Malware payload", "value": "67032efdad42a6fddbaf164f0af35a871008c5f9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709969019, "uuid": "785f483f-040b-41cc-b89f-b80de11423fd", "comment": "Malware payload", "value": "3bbed4c5830582ab3a586cd9edf3b7e4699e2fbb94b0e8a466262609d01aeb44ff8b24a01b8e6fa7fd5f0873e5d65093", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709969019, "uuid": "62b00592-2552-485c-82b7-865ac895cf07", "value": "T10C762324A1928E7DDE1756FCD04E45EB9BAFDDA317C5007327F09AC5CA642D0842FE1A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709969019, "uuid": "221154c2-ec50-4ab1-8292-a4e10ce0f33f", "value": "a0722f4d4407b49f848f72fd4df721d0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709969019, "uuid": "e8f40f99-f3e2-4342-bb2b-1eb921b9967a", "value": "196608:AlTzteipPZGlAa9IATKS3tmpXTqaAGwu4zE:AlTzteuxbAd3yBwHY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709969019, "uuid": "976f6e2c-42c7-451f-a345-ac7a403972d1", "value": 7220488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709969019, "uuid": "691cc4ea-0d13-449e-82f4-74bf4edd2e4b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709969019, "uuid": "8d6e3873-1a34-45ac-bc56-495c08d808e8", "value": "SecuriteInfo.com.Trojan.Siggen19.3578.22324.23506", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7432316-ddf1-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1709974126, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709974126, "uuid": "e64bb117-a182-40ba-baa8-278d5659a188", "comment": "Malware payload (RemcosRAT)", "value": "46d263340dcbdacf1fb43cc17294895b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709974126, "uuid": "c1c6af61-300f-48bf-aebd-fe9960f01349", "comment": "Malware payload (RemcosRAT)", "value": "1391e7b8e3c2c3148c12b0137c1c7c0acf4697d2fed3c5c9eae4d8f9599018f9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709974126, "uuid": "f0e49199-8291-4667-98c4-03fb0d926234", "comment": "Malware payload (RemcosRAT)", "value": "5cfcb0efbeab653b6f5068530892e35be8734649", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709974126, "uuid": "5b5850ce-298f-4c0f-bf83-d3eb74304e43", "comment": "Malware payload (RemcosRAT)", "value": "76320dd2580203ecc38e82bf419343fd04e820181b04a672597da135db226ce986f9d811241878058693dbe99bf924d5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709974126, "uuid": "a218bbf2-f2ea-44ba-b6d6-e4dc3d7ca742", "value": "T1B8D4F012DBB2EE37DBF472FF045476161D5CAEA04CA0794232ACF588FDB3A42C948596", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709974126, "uuid": "39d2f346-8f46-4543-bb42-c96017b01f3f", "value": "e2a592076b17ef8bfb48b7e03965a3fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709974126, "uuid": "daf91abd-c3b0-4616-aee9-64a733801c45", "value": "12288:Zc7/RFFxZzaqefdbCKlCmt1yjDlCrT9yZpnuMUv//zaprF7J2:ZE5FFxZ2qEdbtujDArwpuMUPzmFN2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709974126, "uuid": "70e279a5-7b51-401c-93f4-7455fbbb4bce", "value": 618080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709974126, "uuid": "a11e18fa-9575-40b5-9205-ef476e13ea64", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709974126, "uuid": "b013f285-ea21-4899-a117-ed2e62c105fa", "value": "Group roominglist.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "defd8699-de38-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1710004633, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710004633, "uuid": "b40d27d8-df9e-429d-b9a6-c81d73c509cb", "comment": "Malware payload (Mirai)", "value": "aec6b6cd560844b36e40a424f286a2a7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710004633, "uuid": "957c1fda-cccf-40e6-a20a-ffd1660112a9", "comment": "Malware payload (Mirai)", "value": "1402f3326122cec3fbdd2242cb123919689714eb3c6f2f356f85c41b7e04e62c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710004633, "uuid": "8593a0aa-1a98-498a-97da-727d3dda762c", "comment": "Malware payload (Mirai)", "value": "2d645e7b26d74ee6d56f8b4dc46076d774ee5252", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710004633, "uuid": "29ac3b46-0395-4fb1-b976-d0688340fb4a", "comment": "Malware payload (Mirai)", "value": "d1b10296320acc01157e35df9310b272edf17ae6ea325a1fdeef16f6eb2083b44fb653e1975bddc8c99cb0df2adca678", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710004633, "uuid": "a8207663-af52-4d01-9b93-8b2db9609d02", "value": "T121434A02732C0A47E1565FF4393F27E083FEE99021F4F588260FDA468276E77158AE99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710004633, "uuid": "91dec30d-3780-479a-a651-51c24578e877", "value": "768:kE7b80a77G95pf4ciOoRfMZePm733q2TDC7aWhGCHEgGV3HL3sWt5AIs4s9Jp0EG:kzt7yl4cSFP2HVLWImJGV3HFTsDpW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710004633, "uuid": "8665d59b-5d64-4608-b6b7-ef8f11131115", "value": 58284, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710004633, "uuid": "140d7242-ceca-4586-b68a-14e53ac9528e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710004633, "uuid": "52242194-0b5d-4f92-bb6a-316b93817cae", "value": "aec6b6cd560844b36e40a424f286a2a7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7c7a178-de37-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1710004165, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710004165, "uuid": "8b5ed658-8ed4-4968-9004-521cee9d504d", "comment": "Malware payload (Mirai)", "value": "7f9a6df3b15f9989842d675d3787e4a9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710004165, "uuid": "446154a4-b9ba-4ea1-8c22-1aea26cff140", "comment": "Malware payload (Mirai)", "value": "14fe990d54a17b566de4d6a39604689f6d5af24f6d5cc90b558a5c32515f5461", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710004165, "uuid": "835fcf32-7a77-486d-a36a-d34af0a132df", "comment": "Malware payload (Mirai)", "value": "a2ea0dd0767d602dcaedffe500a0bd2e9498c01b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710004165, "uuid": "89df47e5-3053-4218-a1e3-22bf3dc13fc6", "comment": "Malware payload (Mirai)", "value": "7811a3330bd6901295df2f0c64fc08861f4061026ed6588ba44a0e3cb0814b0795e6a17f3dbff6edb4ab132372e5ec42", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710004165, "uuid": "8501e750-3234-4491-80c7-fbda690a5d1c", "value": "T1FD73840E3E619FBCFBA9863587B34F209648339626E1C545D15CFA011E7034E746FBA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710004165, "uuid": "03ac2d08-4d39-4aaa-9c38-8f4cb24c02ea", "value": "1536:24JMLUay6+vl/h16IOycUax9E2YDsvdllFK0rojDUja8L:Rary6+vdmIOycU67llFjrqDoa8L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710004165, "uuid": "128fe6c1-15ab-4fb8-b526-cd5238a87091", "value": 79804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710004165, "uuid": "d2febed8-ec1c-4cb2-bee9-410ce97631d2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710004165, "uuid": "4daabf10-71f3-46e3-b5dc-5f51aaaa6c6f", "value": "7f9a6df3b15f9989842d675d3787e4a9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "863fdcd4-ddfd-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1709979144, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709979144, "uuid": "ae274c4d-66b2-4221-95da-1ba2b6b8bbe6", "comment": "Malware payload (Mirai)", "value": "ba402fe9f176bbaf3f153896a9955de4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709979144, "uuid": "7e3cae3b-1b42-49b1-bf2e-3027889ec080", "comment": "Malware payload (Mirai)", "value": "1558efb3a49f53f2e241cfd726777af9589a8997cc1b871cb0fc980686c09a7f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709979144, "uuid": "cee80c02-78f1-4c87-8815-c49693fc5274", "comment": "Malware payload (Mirai)", "value": "db70d03b3a0d4b49094c86f4819f11740bf45c09", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709979144, "uuid": "e7758694-887d-4a58-a54c-45838a3ce9f4", "comment": "Malware payload (Mirai)", "value": "1b0bde2fef8953be24e3c6887c0bf1a7e1de0ad70a1168af1e906df5a2c62b89e75e400208f6e5629f8fed1b76807201", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709979144, "uuid": "2d442c73-cc86-4f74-8d3d-068bab5e0ef4", "value": "T154C31A45F8515B13C6C612BBFB5E428D3B2A17A8D3EE72039D216F21378B95B0E37642", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709979144, "uuid": "a320653a-516e-4e4e-9fb0-290f2a351f40", "value": "1536:Jh7JW6nG5k8wfaaFAyFY1LAthi4VvtnTV+HfIo+JSjpChrDObl/Cwyw8FAUk46C4:n7JHg4FpC1Lh4XnR+HfIhMpCho3jf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709979144, "uuid": "12608a5b-9b71-42b4-883f-556864ad2811", "value": 129792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709979144, "uuid": "c3386f39-1499-45d1-bb88-e7e3d8b92d83", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709979144, "uuid": "7a4fe824-a43f-41ec-bbf5-c1aad7689fba", "value": "ba402fe9f176bbaf3f153896a9955de4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc99bbb4-ddfc-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1709978806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709978806, "uuid": "af870753-56d2-40c6-91dc-8ea445067117", "comment": "Malware payload (Mirai)", "value": "2b13c1381f8f48896aa23f0ae9f70c56", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709978806, "uuid": "166d860c-068c-4d90-9122-587abe10e432", "comment": "Malware payload (Mirai)", "value": "155f2146bb8a6f4d99d18b778ca8f5a0d3c6c0cb9a9f4ee65feb99bb31f6d851", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709978806, "uuid": "3c58980e-99af-4fa4-9796-faa3b9f887fd", "comment": "Malware payload (Mirai)", "value": "bba5d67c698d3a7201e50edee32c7707ec3f432b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709978806, "uuid": "a61ccd56-f51d-4fc4-8c21-7d428d4deb02", "comment": "Malware payload (Mirai)", "value": "22039faff184fc97b791b3d5f631e4fb1495accc2fa5136e5f60099751acbf8e5459b9f600f0922e7968c6c350812b85", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709978806, "uuid": "4bd373e8-42aa-4cd3-a49a-995bae89a599", "value": "T144731A46B8818A16C5D413FBFD2E018D332667F8E2DF7212DD105F6477CA92B0E67A52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709978806, "uuid": "2941cc18-e3b5-4968-b897-3d864532022c", "value": "1536:CNnc+HiWFmmhqbnI+l/s/Hw8oXHK+ZvNbSJaOZz1IhiJ4oe/etd42+:2HiWFhonI+qeXZlgp4oe/ef", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709978806, "uuid": "214d71ff-2671-49fa-8831-3f7062bb7f42", "value": 75056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709978806, "uuid": "1e01c5dd-bfb9-4538-b863-a5fad846e54f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709978806, "uuid": "21af7a0b-9308-41f3-8646-978a07d4cce0", "value": "2b13c1381f8f48896aa23f0ae9f70c56", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3ea368e-de37-11ee-b7ea-42010a9c0006", "comment": "Malware payload (njrat)", "timestamp": 1710004212, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710004212, "uuid": "8ca56932-0e4c-49b8-828d-628ae204e304", "comment": "Malware payload (njrat)", "value": "44af8dd4ee2c55e647be0437fed370f0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710004212, "uuid": "2e4927ea-fb6b-48af-85ae-aef65ffcfcd3", "comment": "Malware payload (njrat)", "value": "156c9e2e711fa29cca7e2ad8ce869d99ce15a230829e29511121d1b3c418aa14", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710004212, "uuid": "9b6b9597-1f40-4b76-8d19-e63bb414f0a6", "comment": "Malware payload (njrat)", "value": "516b656fe40340edc5bbe3269d07d0f201d59d05", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710004212, "uuid": "8ed013cb-1624-4271-853e-873235d499e3", "comment": "Malware payload (njrat)", "value": "51afdba00b4069aca7f21316a502d197a30aa0283ccda6e7bc85fb8bf433d31c754ebd1a66a9838470d3507565849507", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710004212, "uuid": "0017f01d-4609-4dd2-9cf7-d4b30bdda3af", "value": "T16D63E12C268E597FF1AAC3396936AB2342E0C896FE70E73C64C3152D5C41B64F659638", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710004212, "uuid": "c99d4d4f-8804-4f78-a59f-3557f0aadaaf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710004212, "uuid": "5635f753-2e49-45e5-815f-ff04e1542ed3", "value": "768:EaYqnFnL0oG4hBojlS28HiZa3bFH241kFT2s2K1lZIHoMos:EaRRzH6LCGqbvEt1JgoMd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710004212, "uuid": "dd955bfb-92da-4181-a2b9-05eb7f3db9dd", "value": 69632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710004212, "uuid": "de3225b8-fe6b-4e98-9442-4d5a94d1d558", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710004212, "uuid": "8650fe0c-61f0-42be-8475-db4779b13c34", "value": "44AF8DD4EE2C55E647BE0437FED370F0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52f2323b-de03-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1709981635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709981635, "uuid": "f9514e84-3f7c-443a-a20c-22a9bae07630", "comment": "Malware payload (Mirai)", "value": "e2e741eea4c32dbf51a416ee4b4e1c26", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709981635, "uuid": "3d584e1c-10c8-4b49-826c-a700a47a9d79", "comment": "Malware payload (Mirai)", "value": "15b450d296c4de932a5aae26e8f2f2339272cf6edd74b884959229441e0d7d9a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709981635, "uuid": "98e89bc2-86f8-40fe-a1dc-8ac056589ce2", "comment": "Malware payload (Mirai)", "value": "bfcd9565b13b6b647f81dd0f778e0068fb50c900", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709981635, "uuid": "c5164dd1-4329-4748-b435-d33f4730bc4a", "comment": "Malware payload (Mirai)", "value": "f0c73f4a34fc60132da9ea275da27d408aa741d29afcf130be7de78320519e62de505402b5e94be38d47a40026b4553a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709981635, "uuid": "e2177466-cd61-4753-827b-f59a5bf70cf3", "value": "T13D937DC5F243D0F5EC8705B15137AF379B33E0B91029EA43C3696972ECA1911EA16BAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709981635, "uuid": "da70aa76-3e3a-49df-9bab-49d03ec1e3fd", "value": "1536:sUYl80AvyebhzEzASUY3JIaJi7M3gLkiNgKVL4GRUS3tkDNu7:sUYq0ovNHS73JIPIWkDKVEeBMA7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709981635, "uuid": "eff165b1-0714-44c4-b45f-e359cb7a8d48", "value": 89672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709981635, "uuid": "f5896893-2f0e-4f44-9d09-406202a7115a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709981635, "uuid": "d2957cf7-45f3-437a-95e7-7d235d25eeec", "value": "e2e741eea4c32dbf51a416ee4b4e1c26", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c09eee49-ddf1-11ee-b7ea-42010a9c0006", "comment": "Malware payload (GuLoader)", "timestamp": 1709974088, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709974088, "uuid": "a73ccc7c-f283-40ca-ab97-05c014b048da", "comment": "Malware payload (GuLoader)", "value": "7c9618988d19a35f4a397e9d5da7495a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709974088, "uuid": "f5faa674-6392-4b06-a15e-d615e0dbc848", "comment": "Malware payload (GuLoader)", "value": "18c7b36933647a9ce8757a9a84714d05df70e8b2893cbc3adf81d8f8617c231f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709974088, "uuid": "0926194c-547c-4aaa-b366-da20b17566fe", "comment": "Malware payload (GuLoader)", "value": "da8cf1254dab303a31e93497d911db9362466f20", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709974088, "uuid": "528f380e-ebf8-4720-b5f5-486720504253", "comment": "Malware payload (GuLoader)", "value": "225c6782c6677b61f2074381cc9ec8fc2ec3a25823df8af8608255fb295dd874241ac2327f387eed5bc46481732f6137", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709974088, "uuid": "8a8de90c-6760-4e76-84ce-2f15a386b893", "value": "T11FC4F14FE1529496EF6106378557AF78AB0BBE3875C2473253743BBC19322849F3E21A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709974088, "uuid": "58d6cd6b-eab8-4c24-b471-0fbfe17a09ad", "value": "e2a592076b17ef8bfb48b7e03965a3fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709974088, "uuid": "964a0123-0a26-402b-8ec6-86e79c6c1de1", "value": "12288:R4mjiqrwQei4bALRLPqkgoI5aV8l9ELRVOweMc//:RTfeDALmaU6LRVOvMcX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709974088, "uuid": "c1c8ed04-4aed-49b0-880b-13745b99b4e3", "value": 586896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709974088, "uuid": "ba61d1e3-7eba-4793-be20-d88f3a326d44", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709974088, "uuid": "3d106d3d-240b-4ef2-87bb-edb1a7ecd16f", "value": "Arborean.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3467c7f3-de0c-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709985449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709985449, "uuid": "943e2e2e-16ed-4fe1-861b-fb1d200c1e05", "comment": "Malware payload", "value": "8b467c84552de869cae28b5e992a37f8", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709985449, "uuid": "6631a4bf-851b-4927-8b80-93beff362aa5", "comment": "Malware payload", "value": "1911ff41187a4bcf07b5ff96b50bd2ab213a8253fde6c76480f4ef7d4044e0ff", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709985449, "uuid": "f1c72649-036d-47ca-96c4-46ddade60db2", "comment": "Malware payload", "value": "002eb0b026bfe352ce305ec2ec56779739e47197", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709985449, "uuid": "168f876f-bc39-4df1-baa5-11b63e8433c9", "comment": "Malware payload", "value": "ecde652d207332aa2699b9aba9a6d2c66c15a5945e88047d43ce85e160cd8d509f92f187d7eba7d4013eba0a9e346d66", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709985449, "uuid": "f254ceeb-712a-433a-b6fe-91b7c7a2dedd", "value": "T1BF017D113BF24A50D1F74E72449777244B7EF805492A45194094D1086DB1F1DAC2FF6F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709985449, "uuid": "ce17b60d-1ab9-44aa-bd6d-cca6e0ab41c2", "value": "12:8C2p6Wt0m/LM7X0VSXjfek4tdNNtlsDejA+P9cAY5AO8TinYbLn1Il6:8eWtJDbZNXZAAcAeAOYwYY6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709985449, "uuid": "ff9a6c39-5625-4ca1-b40a-36ed2154e5a0", "value": 775, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709985449, "uuid": "e8a1c5d8-5e8b-42d9-b35a-d90eb029fb36", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709985449, "uuid": "d06a2d31-5aa7-47b0-8dec-4f69db75864d", "value": "FAQ.pdf.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df497265-ddee-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709972851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709972851, "uuid": "74f536d1-1ff8-4713-a2b6-13c13c6bb9c5", "comment": "Malware payload", "value": "7573e47ae13c0e172d03bc2b285d7407", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709972851, "uuid": "f4c33eb3-ddb7-4421-a225-4d6750a022bf", "comment": "Malware payload", "value": "1a497a13bd34db28f9c832a0f90f3ff6ad0e438682005610d024020cc28e1ae0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709972851, "uuid": "4fbf81d9-cd2a-42c7-9b48-42649cc7820f", "comment": "Malware payload", "value": "0f1f40dcbb9f25ca6d5e05078579415b1dda0092", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709972851, "uuid": "3e184d91-b3aa-42d2-bb52-89ef2c2e64a7", "comment": "Malware payload", "value": "bc1ffcedc0a8bc7d491f1068f62ae9d7b2ce8682a1d778011c6b09a7472bb3f485851f838d306b6917c7eb578493345e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709972851, "uuid": "2e38f63c-8936-4daf-ac3e-f2de6013665a", "value": "T124F633BD4032DC9CDCD0CEF6CC067D818E08AC6AD56A292BDD94B4FAC4795345B9B4CA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709972851, "uuid": "80bb35d0-43ef-4fd0-af77-28cee6c428c2", "value": "b1a57b635b23ffd553b3fd1e0960b2bd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709972851, "uuid": "91fdd256-f3eb-4663-8f58-a2720b4de5f2", "value": "393216:q3QPrA6Rjh8A8OxiDJTufhwQA0iLZlDPwOPKbLI23z:q3QPkIt8A8lTca9GOPKw23z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709972851, "uuid": "caf19abf-3c1a-4de7-9693-4257235f39da", "value": 15618624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709972851, "uuid": "5a3c29a3-7a02-4410-a07e-19acc036153a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709972851, "uuid": "b5506553-e415-4fb8-842d-53db3c7547bf", "value": "SecuriteInfo.com.Heur.32704.28071", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a266d049-de0e-11ee-b7ea-42010a9c0006", "comment": "Malware payload (DBatLoader)", "timestamp": 1709986493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709986493, "uuid": "f13059bf-5c50-40de-8cc3-5537bf3119d6", "comment": "Malware payload (DBatLoader)", "value": "b07fb71d997c22be4c3a7087df5666c3", "object_relation": "md5", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709986493, "uuid": "d6532ea5-ba61-4470-8886-7283231156bd", "comment": "Malware payload (DBatLoader)", "value": "1a8b52e72353bece5c023abae01fefc44db71a89d482cab2898615a23c4e6a12", "object_relation": "sha256", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709986493, "uuid": "7f6bab65-73f7-4b2e-a923-6efff3dbddc0", "comment": "Malware payload (DBatLoader)", "value": "9ddea0fadeee8696011b1d32888c3c51f66c27ff", "object_relation": "sha1", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709986493, "uuid": "ab791b67-d71d-4edb-8ed2-9e04aebaa5b2", "comment": "Malware payload (DBatLoader)", "value": "4f16c53335eda3b312c95d5d69baae56e6275427e61bd9bed8c3f133c74e0d17c9848eebf6080e2b3b9d3cc2b8c34cab", "object_relation": "sha3-384", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709986493, "uuid": "6eb16399-8a7b-47e7-9843-c6b0d6760cb6", "value": "T1FC258E22A6AC7C33C9D615345EB6F7F41C287FB12D2C9C963BE539284A3A3813835257", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709986493, "uuid": "2e769013-4eff-4575-8958-9131e9a57cd6", "value": "ede4a721a0b9bbea83535c909d0f6b2a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709986493, "uuid": "6e350b5b-e5b3-47f6-8438-2a63976fd8a3", "value": "12288:AfSx+FaMjOnJBReneIPcVCXGmBOVVrd4yABuAMQsWIUN2FELSvVeCs9axIe4nhnK:CkPMjOn/ieI37BOXZ5oiG2F02sIn4hn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709986493, "uuid": "c21e3d3e-c8d3-4def-a275-e3c5e013fd66", "value": 981504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709986493, "uuid": "1fb9eabc-c743-469c-a579-7b3b19c88ed3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709986493, "uuid": "cc5cf273-3833-47f4-b26a-a91214290291", "value": "DHL SHIPPING DOCUMENT - BL - AWB PACKING LIST_02292024.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "607c5730-ddb5-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709948157, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709948157, "uuid": "9dfebd80-cd3e-4821-a688-1072df02daca", "comment": "Malware payload", "value": "704bfed9d71a62e4aec64764495005b1", "object_relation": "md5", "Tag": [ { "name": "pw-marketing2024", "colour": "#71840D", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709948157, "uuid": "85bea558-a588-450b-9c8e-6397c336dc28", "comment": "Malware payload", "value": "1b8f4554b14821e80d6f890da91cb78a1967a845cf3cafc8efd489064a80c9b2", "object_relation": "sha256", "Tag": [ { "name": "pw-marketing2024", "colour": "#71840D", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709948157, "uuid": "3c3ecc0f-f027-47a7-b97c-8b78c6627e3f", "comment": "Malware payload", "value": "692533264ccff863f281d0928f8f82450441deff", "object_relation": "sha1", "Tag": [ { "name": "pw-marketing2024", "colour": "#71840D", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709948157, "uuid": "64ac18bb-500a-4aff-a775-de3172a60c89", "comment": "Malware payload", "value": "763429a69b3b61c327ccf4b2c8ca0f93f1c2cbc3c0a5301cdd44998df45ab47867b10a04ffd6ca5aa27f26408a7d9a43", "object_relation": "sha3-384", "Tag": [ { "name": "pw-marketing2024", "colour": "#71840D", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709948157, "uuid": "3e71f903-ab35-4a5e-a039-54f1416805d4", "value": "T1B5E7339B2C580AE7621534180B1E72DEA34FC360B576A9FDEF5F9ECCCB39428909519C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709948157, "uuid": "59fc1eae-46b3-46ed-b735-bf252a7892fb", "value": "1572864:+PxAaLx/xpunrgHL4PZjxA/qPkcdPjt6C4mlUbeEkwW:Gq4x0841xA/qPkcNPUbeE/W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709948157, "uuid": "86df1ca2-65a0-41b3-8c93-b94307129e07", "value": 69282631, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709948157, "uuid": "97634658-cc41-4c66-a946-2e56c65ca517", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709948157, "uuid": "2bcd31e8-fcf2-4583-bb29-3f9815f1f6b5", "value": "Google_Digital_Marketing_.xlsx.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b56aceab-ddf6-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Ahmyth)", "timestamp": 1709976217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709976217, "uuid": "b8169105-284b-477d-9ad9-72d9b657658d", "comment": "Malware payload (Ahmyth)", "value": "caca3ea76d9d6ee87e940dc1f59be0a2", "object_relation": "md5", "Tag": [ { "name": "Ahmyth", "colour": "#BA38F8", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709976217, "uuid": "dcd71d34-1858-4e9d-a4f9-812670ca9884", "comment": "Malware payload (Ahmyth)", "value": "1e1e23c920eeaca8e9ffc1f946fcb978fa2419815b7b5dcf9a1cca9b934f8c4b", "object_relation": "sha256", "Tag": [ { "name": "Ahmyth", "colour": "#BA38F8", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709976217, "uuid": "80d906a5-6520-4916-ae0b-f1b24a344f53", "comment": "Malware payload (Ahmyth)", "value": "92750f9fcc351cb81da89e0fd0c0714a652ea385", "object_relation": "sha1", "Tag": [ { "name": "Ahmyth", "colour": "#BA38F8", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709976217, "uuid": "fd434bc5-22eb-47b1-beff-4783daaa7276", "comment": "Malware payload (Ahmyth)", "value": "6ddf5822c461b2468748c902627f0c27591a4abf7f5e570a7df527e7af97ff6806433b47932e3c99de4545054a6904a0", "object_relation": "sha3-384", "Tag": [ { "name": "Ahmyth", "colour": "#BA38F8", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709976217, "uuid": "5e8f9788-b35f-41ef-b6db-73764f92c423", "value": "T14876F187F788A95BC0F39332897656A640074C268B43DB876F58737D18B7AD44F4ABC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709976217, "uuid": "faab8166-60c5-4653-919e-686387a38f3e", "value": "196608:JufylomtfNdXosThdl9TJbYX2kkJslp9y3gU:J08nf7d3lDbYX290U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709976217, "uuid": "064ef09c-f91b-4790-b730-21c671872377", "value": 7442279, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709976217, "uuid": "5196fa17-8fcc-4e0a-8c6d-4a23d2c7f126", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709976217, "uuid": "c568eff5-7201-4a9f-84c1-74645b073090", "value": "flash_light-aligned.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ab4988d-ddf5-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1709975662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709975662, "uuid": "f5f5b67c-3d62-4720-ae08-05cc4fa487a1", "comment": "Malware payload (Mirai)", "value": "b7dd43c0a119da03d425d8a49e06c1c3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709975662, "uuid": "c4a494dc-f431-4e00-88ed-fa05f3171615", "comment": "Malware payload (Mirai)", "value": "1f491f97d18d2845fc2544bdaef8eac50f1c66904a91b2c999648107ad6b75b9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709975662, "uuid": "28cf8f20-3884-4347-9803-1a673f6d7fcc", "comment": "Malware payload (Mirai)", "value": "80652fddec2d2d74632ff0613583f1c0e0923942", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709975662, "uuid": "99fb0bd4-1560-4291-83a4-a40ee2afe409", "comment": "Malware payload (Mirai)", "value": "3498a2b28a51a631ea7e8b91940e359b3847af025f5de1f64629cf3f04aab3417ea3566d6d8c91be89c25d74e120674a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709975662, "uuid": "64570678-f651-4192-a8d3-cb856e4d9e35", "value": "T11353F78178818A17C5E423BBFA6E418D373563F8E1DE3216CD116F6476CA82F0DA7B52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709975662, "uuid": "29799302-4369-4105-aa50-eff53cd3e979", "value": "1536:+z+oGfLRsu0yhLSL5SM5sD7EzclG9W68rLcdrXd42+:+zYLclaEzgG9t8kdrt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709975662, "uuid": "32e58eee-9670-455a-9a87-05ca3609213a", "value": 64460, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709975662, "uuid": "b9ecc0ec-cb83-452b-8f46-e31e13866992", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709975662, "uuid": "c5849906-1f67-42a5-bdcf-6b384fa1f7f5", "value": "b7dd43c0a119da03d425d8a49e06c1c3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82684aa2-de49-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1710011779, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710011779, "uuid": "d0a057e9-aa6a-4133-9a28-8a08d18ef8dc", "comment": "Malware payload", "value": "2756070df4e8bddd0c7f3fc96f4cdf0d", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710011779, "uuid": "6b5edd3f-3a32-4fd0-b975-25f2eb2706e7", "comment": "Malware payload", "value": "22177ff2b587013092d1a53abcb6d85f6a08d840c296db6865af27d7d7e0f97d", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710011779, "uuid": "53cc8caf-a96e-4dab-affd-76c52e1cc134", "comment": "Malware payload", "value": "2b303df96b4dc52f70b2b317229d72203fc1f78e", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710011779, "uuid": "3f161952-7e75-4d59-ac31-ade0eb9054cd", "comment": "Malware payload", "value": "7c8804e992816bd2dd4ff07b5c08f4d312aa76668dbe02c0b8664dce5c80f8c87d18e6ff41e0547eafb295c9a000e800", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710011779, "uuid": "0823dcf5-222d-44c7-b842-25ed58625622", "value": "T1C1E4BB078C088B83D52893F8BE475EAD1F5A6B1CE5923AFF41160DCB7F606621C9E52D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710011779, "uuid": "67597d85-559b-4c5c-820e-b4c3fc56a15e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710011779, "uuid": "6a36a4e2-c4b5-418c-8588-861aa8d1d5db", "value": "6144:usL/nKtKbxdrUFgj00Z6dO1FvgbOpVQF2UhhN8L3KnKuDx64RW7bwoV66wEBCLAH:Pvo5FK00Z6MbQBhOKKqx6maVXELAcQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710011779, "uuid": "3501f598-d11a-403e-95a4-0a18373196e2", "value": 709376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710011779, "uuid": "0ad4ba57-e800-4094-b7b6-9e7cd2d244a4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710011779, "uuid": "5015c313-1591-430b-b17e-39188a526c55", "value": "Program_0y4vUZA7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eacc53f1-de3d-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1710006800, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710006800, "uuid": "fb40e15d-8799-41f8-a5d4-f5ac8d9b0fe6", "comment": "Malware payload (Mirai)", "value": "0894305ade4402e3d6e80854c1abf748", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710006800, "uuid": "2b061246-6e3b-4583-85af-439748265739", "comment": "Malware payload (Mirai)", "value": "223b40e946f41ed20b093d253c113f248e441e7c69598e24c340fae4d57c1c20", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710006800, "uuid": "c6c2c959-e430-4943-98d0-32b34f254a92", "comment": "Malware payload (Mirai)", "value": "c2b6014284c9b3d3f07e47a9d3a8d5fff340a51a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710006800, "uuid": "37169e02-c657-4954-b640-5fd4929b4edc", "comment": "Malware payload (Mirai)", "value": "59a102f360ad7680272eb84f3e19a8277c24bce4bdadb6261a87c2980a0b9554d9b29a3c8ad4c2de6f6bec0260472572", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710006800, "uuid": "cd32829d-a7fa-45cc-bef5-4569cb712e1e", "value": "T1FCD32A05B30C0A47D2632EF43A3F67E093EFDAC121E4F640256FAA8A9172D365585EDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710006800, "uuid": "6c89e3c6-5af4-4a2d-9587-a9467c454491", "value": "1536:6ApYWLEkYvb5IM2+P1kyxgxpzvTLLNcsvtggg/LPMvgvAVIRc732d3qSC5Ggkm7f:u92mkyxgx97f93gjPMNVom7jjmE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710006800, "uuid": "59da2fe5-9ed1-4628-a8a9-1bf2d5a22759", "value": 132344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710006800, "uuid": "ee2736d7-4740-48db-af8e-8dc9b45b4491", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710006800, "uuid": "988f14ce-0f46-483a-8fde-4d97dd1fc790", "value": "0894305ade4402e3d6e80854c1abf748", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9bca91e7-ddfd-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1709979180, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709979180, "uuid": "b321f631-8fc0-451d-a738-0cc3af91ff2e", "comment": "Malware payload (Mirai)", "value": "d9cabc16f27379f0c5a4cb1d33954835", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709979180, "uuid": "853b2b1f-6b97-4d16-86cf-67587eead8b4", "comment": "Malware payload (Mirai)", "value": "22c99433627bc0d337304611aafdfc7d9bcbbc3370154ff0dcf2de7d5e2701dc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709979180, "uuid": "9ed87035-f795-43ba-9d44-4c595762caef", "comment": "Malware payload (Mirai)", "value": "918586a2cb97684c04dc60cd329f6e05b04e9904", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709979180, "uuid": "2c875589-dd9c-4d47-86ee-e26cee10621b", "comment": "Malware payload (Mirai)", "value": "ed9477fd1a516f35a09cfee0ba5f6b093889ca57efe61c0967a75714a14d7cdecc1f9d2cbfdf471c658659c0ff09714f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709979180, "uuid": "3262ee31-0e24-4ed3-b100-b9845cbfcfb7", "value": "T1D6F2E1D3A700E8F0FDB12C2E6D754493FE632AF0C09E90121628A794E9BD7447979D62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709979180, "uuid": "943adbb8-3e4c-4fa1-a7ed-0a5922d3c673", "value": "768:VJMSy5urpylDLXPnDMPGK2ZstFi/+AQOkVX4D9xewq3UIOa:1prY5PnQOK2yc/+pORwHF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709979180, "uuid": "7a60a7c5-2b78-4f31-b5fb-4d2f40480738", "value": 36624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709979180, "uuid": "deae5d7e-f56d-4322-b1cc-21745be83e5b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709979180, "uuid": "7d8713ff-97cd-422c-8d13-f19b426af956", "value": "d9cabc16f27379f0c5a4cb1d33954835", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eeefe394-dde5-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709969012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709969012, "uuid": "d3e98382-1b18-4826-863e-f3aae0a89e69", "comment": "Malware payload", "value": "150356809844d31fda2d2032aa319bc7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709969012, "uuid": "de13bf1a-609d-4636-9448-48a08b158fbf", "comment": "Malware payload", "value": "2385459baa197502dd1edb4f709dfa9c5aae1e927fa255cb419b21de2e63a973", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709969012, "uuid": "fd1f4650-8ade-4cb4-b975-870778a497b7", "comment": "Malware payload", "value": "9bef22530720ad3f23913b116a0651606d2fd912", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709969012, "uuid": "adf531c3-8818-4d96-bbc6-458065e2dfbc", "comment": "Malware payload", "value": "a48d772f0e4b8592227a9487a75623e5190ee0a30c08ed0c85cef95da3322917db518e23f0fbdd2c21523a4a6ce37ea9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709969012, "uuid": "8e30ae8c-cd4d-46df-ae9f-631e0cf25820", "value": "T12434B31082868526CA7F0DF259FF0BB96A74AFB10B0194F783D93C3D19792D66E3225D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709969012, "uuid": "6e78f638-c93e-484c-9563-104ea48e7754", "value": "ae3ed54db4ec236c6afd5780f4278b16", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709969012, "uuid": "6c8af751-2741-4019-8dc3-d7a3716c85f2", "value": "3072:CYIwWKGhzwSJ+WND61AgR5WWvdLYUeBY94ri2AxT1:CYIwWKGhzt4s8AGWed/p2q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709969012, "uuid": "95a2af71-8be9-43ac-897f-3f0f98faecda", "value": 253184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709969012, "uuid": "20c80182-c026-4a44-a982-c9bf6a1c3fc1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709969012, "uuid": "e7aa7e70-9bcd-4454-9f71-dbd077e916d4", "value": "SecuriteInfo.com.BScope.Adware.Presenoker.2863.31240", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31222557-de4c-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Matsnu)", "timestamp": 1710012931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710012931, "uuid": "27cd1cd4-6c56-4a74-bd17-8ee44aa3a1e5", "comment": "Malware payload (Matsnu)", "value": "361ac442e0074826f7af16f5e897cf4c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Matsnu", "colour": "#67002B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710012931, "uuid": "dc21d4d0-0563-46b5-896f-44af67f0edbd", "comment": "Malware payload (Matsnu)", "value": "23e5dbb6b51e056ecd17805ae31adb3f515b747924445b5e0b73af1b815301c0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Matsnu", "colour": "#67002B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710012931, "uuid": "a7c6b71f-e53b-4477-bd68-71f62260ba97", "comment": "Malware payload (Matsnu)", "value": "3bbcc5c6307d41681730655644c5d1bd772542d6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Matsnu", "colour": "#67002B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710012931, "uuid": "f606bb3f-669e-4857-9b5a-2d35e10b4fec", "comment": "Malware payload (Matsnu)", "value": "bbb4b58c2de9ff76ee1c0e422834299051e218ba98eac27ceaacb96f974790f64ae905855779a59f8ee43fc1dba23937", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Matsnu", "colour": "#67002B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710012931, "uuid": "21624e65-0686-4963-a7ae-65336cdaafd0", "value": "T18C53AFE23961CFD7E94E5570216ACF005EB3A99B02F00547EF61664E5C7C2E09A3F19E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710012931, "uuid": "d1ea290c-e93c-46a9-8657-dd4bbfa806e3", "value": "e876491ed67b7b28af30b4900505ddb7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710012931, "uuid": "c2c1c47d-64b2-4f01-9d9c-4e14c98eb173", "value": "1536:oYM4V5551M1AnB+3o5FCs0u9zIyGPMPnXz91:35VPM1YUo5FC9GzIfMPnD91", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710012931, "uuid": "a4c327ef-22b5-4b19-b47d-31f5e4c49da9", "value": 61440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710012931, "uuid": "f8b35b43-92d7-4d7e-820c-6157ba02d92a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710012931, "uuid": "516edd5f-7385-49db-9e18-c6ff8c7d0fd3", "value": "SecuriteInfo.com.Trojan.DownLoader10.11261.3039.981", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5e7028e-ddfb-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1709978419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709978419, "uuid": "b47d219c-9a03-4c53-8dc3-b1f498f0a034", "comment": "Malware payload (Mirai)", "value": "94e5efe0a132640f95d6e4403e078eea", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709978419, "uuid": "95a0f21b-6a91-4406-b569-9b9f08e771fc", "comment": "Malware payload (Mirai)", "value": "279e0543d2b7fa717a1511848d5b8f8782ae4d511318ad2368fbc9b15ab40514", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709978419, "uuid": "55518988-cc8c-4202-9aba-e3e18f7c182f", "comment": "Malware payload (Mirai)", "value": "1a771f417ec9ab7c7733427039e3afde8e2f3ab2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709978419, "uuid": "a0965def-0926-4322-8a40-80c0c65da579", "comment": "Malware payload (Mirai)", "value": "dbf0136034e38bf66bfc8155d5e745f05cf192eb319bb96a2834a3371ba9d689fa15c9d30d79c4245503154f499d6721", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709978419, "uuid": "019fb694-18ab-4919-b215-a7df33c09a8d", "value": "T14AD32A05B30C0A47D2632EF43A3F67E093EFDAC121E4F640256FAA8A9172D365585EDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709978419, "uuid": "2c509824-b08a-4627-a7fd-7b003702178e", "value": "1536:6ApYWLEkcvb5IxPR+z1kyxgxpzvTLLNsoghM8gzLPMvgvAVIRc732d3qSC5Kgkmj:uUPRakyxgx97fR8gnPMNVcm7jj20", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709978419, "uuid": "17c217d8-a9c7-4f5e-8f59-bf65827a8212", "value": 132344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709978419, "uuid": "54ccea1f-28b8-4a08-9377-718df04f0d9c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709978419, "uuid": "5a4ce06a-5bf2-490d-96cd-223a8a275833", "value": "94e5efe0a132640f95d6e4403e078eea", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdc86525-de26-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AsyncRAT)", "timestamp": 1709996846, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709996846, "uuid": "8ee2a9ee-9d09-4d8b-8d80-b0183c652b2b", "comment": "Malware payload (AsyncRAT)", "value": "8bc44f04e9de554c305aa7f800757ccc", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709996846, "uuid": "4632c373-83ff-48e0-8d25-debdbef1ad5f", "comment": "Malware payload (AsyncRAT)", "value": "29f3c5f06270cc2b6edd54a49d485edf762a82054ea84f643c57a86e176d3799", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709996846, "uuid": "1c5aabad-5603-4e11-82be-8e23782ee945", "comment": "Malware payload (AsyncRAT)", "value": "3618f356016c6773c795dc99b78500ddf0d913f2", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709996846, "uuid": "0db71c73-bffd-4d0c-8c27-54751539e133", "comment": "Malware payload (AsyncRAT)", "value": "9c6c8ab4b15736d94a7b039b7ca880d6eee2c91c372d51b8cfc71d6b6d5ab66b536873804aea436363a13b713a3295a6", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709996846, "uuid": "727edfe8-7883-45ee-b11f-5fe721cffe78", "value": "T10D232B0037E9812BF2BE4F78A9F26205867AF2772603D6491CC451DB5713BC69643AFE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709996846, "uuid": "ed921e51-3d8d-4383-b5d3-bf05060ab8a6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709996846, "uuid": "4eb3eb6b-bcb3-4241-94d2-3c386634d429", "value": "768:NuPfZTg4pYiWUU9jjmo2qrlqyx0OUUwdrxIkDPI5zjbQgX3ibUC0aWI9bKFBDZOx:NuPfZTgKa2mqPTNM53bXXSIxNI9bKLdM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709996846, "uuid": "d35c865d-8153-4ac5-96bb-daaf2b0fe4bf", "value": 46080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709996846, "uuid": "5834b056-df4c-4cad-81ad-792f2c5f9291", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709996846, "uuid": "5b72dfe2-f3f7-431c-9003-59036e1fa5ad", "value": "bUav.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee9dff3c-de37-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1710004230, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710004230, "uuid": "7d5d5964-697f-4513-b4c5-67f16c66ae5c", "comment": "Malware payload (Mirai)", "value": "97f36910e1c3b90a69d4e9da7b3d45e2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710004230, "uuid": "fb16f55f-febd-4962-a7a4-0b5f664dc320", "comment": "Malware payload (Mirai)", "value": "2a2ab4fdea61753e71c2af4a7dec171fc6606f051febfc6574459922f0683f68", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710004230, "uuid": "8faaa145-529c-4d20-a1df-80120c0fff28", "comment": "Malware payload (Mirai)", "value": "d845d218073f2efabf1fe3150ac88c4cd052083e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710004230, "uuid": "80301ba7-3c6c-4350-bea2-04847929e159", "comment": "Malware payload (Mirai)", "value": "2f43be9229e67c9edf3c295aa5372d3e88452e65e582d7cba3db74d13cd4cc6e2f677bd580c769ab7533e6da4275d8ba", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710004230, "uuid": "017d54c0-eac5-4e81-8911-922e579a6849", "value": "T117639209BF611FF7EC6FDC374AE9274525DD641A21A83B397930E818F24A24B19E3874", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710004230, "uuid": "1b44d04c-55a3-4069-bbd4-f9b990583dff", "value": "768:CDScD5GY2naf8i2Sxt9yYExR1QIT45fTemle5Re5brvuX5XiANe1j9xE:CDSC5G9afb249FKn4pfl8RWb7Sq1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710004230, "uuid": "5de61316-5c27-498c-b0b0-1b3a2f5139ce", "value": 71568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710004230, "uuid": "81c2af25-6fb6-4302-97ff-bc5e5b57d323", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710004230, "uuid": "ad8ae747-56ad-4fe4-8af3-c64187de8376", "value": "97f36910e1c3b90a69d4e9da7b3d45e2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a76279df-de0e-11ee-b7ea-42010a9c0006", "comment": "Malware payload (DBatLoader)", "timestamp": 1709986501, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709986501, "uuid": "fd2b8dcc-5dc3-42c4-94d5-38b47f991788", "comment": "Malware payload (DBatLoader)", "value": "ff8c2033755de9420b73d2716f327ab0", "object_relation": "md5", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709986501, "uuid": "c5922cb4-fb29-4b47-ab30-a3b4381d9681", "comment": "Malware payload (DBatLoader)", "value": "2e653bbbdf38d469acd5a8b993875f4b96e51a1c3a92d56a6b2f5e3bd4a207ad", "object_relation": "sha256", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709986501, "uuid": "a3a58ca1-b74f-4bbf-a42b-a088b67326c2", "comment": "Malware payload (DBatLoader)", "value": "9361ebcf549d1a124922a9ea335dae9e1e368a6c", "object_relation": "sha1", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709986501, "uuid": "101b8dc0-162b-4eed-bee8-c2424292cb73", "comment": "Malware payload (DBatLoader)", "value": "6d7bf37e008f32edfd181b84e844b39a3ad4008756ab34a7ced651ceb51dac14917116b944afb49ad44a43c4c1ff2c60", "object_relation": "sha3-384", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709986501, "uuid": "d7a856c3-57b3-4b22-be8b-60dd0f88437b", "value": "T1BE259E23AAACBC33DD9255345EB6F6F46C247BB52D2C9CD57BE035184A3A3813839253", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709986501, "uuid": "da258c46-3b31-4452-9969-9db2c529d2d9", "value": "ede4a721a0b9bbea83535c909d0f6b2a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709986501, "uuid": "138129a8-4889-4fbe-bdc7-5707dadff15f", "value": "12288:AfSx+FaMjOnJBReneIPcVCXGmBOVVrd4yABuAMQsWIUN2FELSvVeCs9axIeKnhnK:CkPMjOn/ieI37BOXZ5oiG2F02sInKhn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709986501, "uuid": "755fd765-cadd-4e33-bcef-871ade2ce573", "value": 981504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709986501, "uuid": "cd42aedd-9562-43e1-b0b8-af51d9b1cf6c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709986501, "uuid": "96cbe04e-5e3d-4058-ba74-f33b7e58ac2d", "value": "DHL SHIPPING DOCUMENT - BL - AWB PACKING LIST_02292024.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7264aa26-de29-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709998008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709998008, "uuid": "70d29bb2-6649-4c0d-a8e8-6a22d5a86a2b", "comment": "Malware payload", "value": "d415c4e401c3815c796b8bc4ac1e29ec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709998008, "uuid": "fc259aa1-2046-4ae6-8859-117f6b056449", "comment": "Malware payload", "value": "328cc7d3a1e52b55b74bebfe2954c6e0909703f80c2114d085e3da77a1271ac1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709998008, "uuid": "d63cb9a2-61a4-48b2-b930-784672f0ee8d", "comment": "Malware payload", "value": "22f48a886f0029346313755f1ec9ed3a4980f3c4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709998008, "uuid": "d0b26204-fe70-46e0-a952-f1e704b80b82", "comment": "Malware payload", "value": "6e03250deb68b9fdaac412fef64b7bb742c91d56637e5916c618acb53dd5c6dc5617de0790c35690a353bed818f610de", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709998008, "uuid": "bf6ca442-db28-4495-aae5-ea12fb6dfb33", "value": "T1CFE5AD21FB878DBDDCFE057831DAD77B88369D284325D7D397942D5A88202E16A3E384", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709998008, "uuid": "78e1b97e-7b0d-4577-b352-902241378522", "value": "7ccb786838b671248894256b6e311648", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709998008, "uuid": "8957d87e-5ad2-4946-af01-f867443d7e32", "value": "49152:aE2Ln5nyEeNI7eI+IBH8cSdvQ/qpyr0k8T9o4PIQAu1QUm5YDgSZGlmc+pycVcWz:afhyEeN1IBHavQ/qpyr0klBQA4QUH00P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709998008, "uuid": "73506349-6d01-4ee0-a082-a5ba06aea05a", "value": 3103072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709998008, "uuid": "67606a34-3672-43d0-ac69-00c7b63d2a8a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709998008, "uuid": "a8ab2298-2a30-4b1b-947d-2057f7b2ac91", "value": "SecuriteInfo.com.BScope.Trojan.Wofith.31019.7691", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f152dfc8-de19-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709991349, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709991349, "uuid": "5949fed1-06e2-4acf-bb05-8a31b123191b", "comment": "Malware payload", "value": "855d4ae7b91542c4b10d3c573e648028", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709991349, "uuid": "2d58149a-eeb6-41a2-8a4a-a53af7116602", "comment": "Malware payload", "value": "35fd8b4fda8b89b188a9d009584c983767c58dc22c34859245766ec3c2c1a55e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709991349, "uuid": "09385668-b14c-44e0-88e7-1fc0a5e36e0a", "comment": "Malware payload", "value": "d3f3045cd972d11421ca8a71d32f3f60e83171bc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709991349, "uuid": "74531592-b275-4a77-872c-ce9f9e0132a4", "comment": "Malware payload", "value": "ac191344157220138335a909d06fc8b0e108aae8874c2786cc8b7ce230fda93e495bde2d7bb0bbb1f1fa82341a468fde", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709991349, "uuid": "192b3be4-b00a-453b-b0de-6ada45387b7c", "value": "T14AD2E170B1F02CBCF29405F4F5D643469BE80ABD74A77061B66746D5F092AA623BC08F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709991349, "uuid": "eca84490-a0ee-457c-abc9-771e88d1883c", "value": "768:8DPzqSFpKCj7adky5RrDCo+Ck1LWRrLfV/wcvB3U5:sPzqSFFty5RyPcRLfVLC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709991349, "uuid": "f73c2bcd-b923-49fd-bb9e-867d9804d725", "value": 30798, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709991349, "uuid": "1d02561e-0a01-486e-8904-55dadcde8d05", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709991349, "uuid": "4ce88183-ce59-4b92-b1ad-81d05cb10fbf", "value": "SecuriteInfo.com.Linux.Siggen.9999.19388.17703", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f83e048-ddf5-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Gafgyt)", "timestamp": 1709975643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709975643, "uuid": "6024f855-ade2-4fda-82d0-b9cf438b049e", "comment": "Malware payload (Gafgyt)", "value": "8cfdab4d7a2e2d35bd6dbf928cbf5a3f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709975643, "uuid": "f1e56d74-c003-4210-9397-39d392f081fb", "comment": "Malware payload (Gafgyt)", "value": "361010ba5bb67f04ff439dfbf91d2c080d9ffd7a4959bae45c1c92b3ffde4e81", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709975643, "uuid": "c110c2cc-0074-468b-afc5-542d4aaa7b15", "comment": "Malware payload (Gafgyt)", "value": "3c5fef8846623650a846df08a417973552d69c8d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709975643, "uuid": "252a98a5-aa52-4f77-8ff8-0ec858fe22b9", "comment": "Malware payload (Gafgyt)", "value": "b51bf076e8c9c087a67d7466afccd7947e21d91248bd79f8b030cf801262c9a5d5956daef7cbeb5b9d35dd3fbc2e0c31", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709975643, "uuid": "cfb901f5-32f5-474b-9de4-f6781e2f0a31", "value": "T16FB35A66FE409A66C5D15176BB2F038C373B4398C2E9B6039E359F6077C7A070E36989", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709975643, "uuid": "64557f92-d6b4-4e8e-a516-88495988d35c", "value": "1536:c9U1HjaWqyyNyDV4vL7YVsD+2FdcFwh6axUKdUv6Hwqw8bTH45xL32vet:c9UtaW7J4v+8xFdcF86axUN6QUTc2mt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709975643, "uuid": "d41b223d-2b49-4993-893f-af749533cd9f", "value": 107516, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709975643, "uuid": "c30be139-c78f-48b8-bfb4-0b3db26aab0f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709975643, "uuid": "dd3a7eaa-fa94-413b-8ca3-29279e0de765", "value": "8cfdab4d7a2e2d35bd6dbf928cbf5a3f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f44c29a-de4c-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1710012928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710012928, "uuid": "55209ae4-006b-4f12-8188-59778700e6f7", "comment": "Malware payload", "value": "841b5b135542aa377ec464de67248883", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710012928, "uuid": "f9617666-cbdd-4ada-8114-f43c38bcb92f", "comment": "Malware payload", "value": "36272aada04f6150fd0a92f081bc6be0c457cacad6cef94a9599a027dcd2a4ee", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710012928, "uuid": "94c54430-d3ac-4127-94aa-c77d6f95da6c", "comment": "Malware payload", "value": "83dd44f59943c45bfa73ce06b131931065543b7f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710012928, "uuid": "c617c5f5-2795-49f6-95f7-805395f5e552", "comment": "Malware payload", "value": "b6755bc27c98de8fea951d095396531c848492f7c363e053acea98f974bc8f1a1e929a25b0efaab548e24959fa40e58f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710012928, "uuid": "558838a1-4c17-4edc-9824-fa3d88677dfb", "value": "T14E932F1EB3C7F38EED7BD27E0F5A4A7165E5299B03BC8C72851F65882437180DE1A182", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710012928, "uuid": "eda0c00c-dbb7-44a4-acd2-b207da366ed0", "value": "384:6wYWBesNGEvAIiXSD/RtMV4ksOJzkyrPzHLEx/W/wHq+fztUmT966o+ctx:63WBeoG+AILD7a4NONkyD/ExPE6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710012928, "uuid": "39b35476-ee80-49ba-8986-e687a80a641e", "value": 90112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710012928, "uuid": "3949b92e-54ba-4132-a380-42a66768b709", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710012928, "uuid": "6892bc0f-0aea-48df-bb5d-3c33372d0363", "value": "SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.32172.11706", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6bdc5df-de3d-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1710006794, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710006794, "uuid": "d27ead77-9354-4ba3-b16d-b7afd4ae114a", "comment": "Malware payload (Mirai)", "value": "b3642e89d2d7059fcfbb2aefa46fb7ac", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710006794, "uuid": "8667712f-c023-437a-ad68-79e48e6f2bf9", "comment": "Malware payload (Mirai)", "value": "365062b1b3d9602e5e6609edbec63e25684178a32ddd8613cf82e706fa2cbf88", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710006794, "uuid": "71456b3f-c982-4a3d-8a33-5f1532cb2502", "comment": "Malware payload (Mirai)", "value": "e58866437704b70c7fd2dcf041ffddec580e6fa8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710006794, "uuid": "f16a8c11-3398-432b-8a52-79fd578aa42e", "comment": "Malware payload (Mirai)", "value": "63089871dc56e9168012ddd2858213a0ca237a3bfe2616f751a249f91c9a0e28c5f7d869376860836399f0c8d241d703", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710006794, "uuid": "aa8e05eb-8181-42d2-96df-79a297e19dab", "value": "T1C5E329D7F800DEFAF80AE33748530806B530B7E245925A372257797BED3A1991963E87", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710006794, "uuid": "ed4f9cd9-f724-43ef-a3a8-21a20da75cab", "value": "3072:iVIricphb7+zTbqnlnAgsUZKbVrjbixLHReKgyC6lxa:0IrsWnFAUZK4LHRgyCMxa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710006794, "uuid": "2d3575ae-d41f-4792-994f-c875169d1507", "value": 150464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710006794, "uuid": "332580b6-244e-4c02-8d2b-4520e08a7693", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710006794, "uuid": "3cd18b6c-50b6-4bab-82ab-a44e53c6849a", "value": "b3642e89d2d7059fcfbb2aefa46fb7ac", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "caa3e33c-ddf1-11ee-b7ea-42010a9c0006", "comment": "Malware payload (GuLoader)", "timestamp": 1709974105, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709974105, "uuid": "81d08b16-926a-4b26-b2a5-1ec5367a9671", "comment": "Malware payload (GuLoader)", "value": "e0c8fbf5d296dedb54d751ac9f261f6e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709974105, "uuid": "0e6db4d7-f7c6-497a-bca5-0a14f371700c", "comment": "Malware payload (GuLoader)", "value": "3670a1edba98317b7a16dee57b27e50b2c9d130142a64faac0c2845633111f42", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709974105, "uuid": "deca0a83-d1a7-4b3d-81e4-6382eae576d6", "comment": "Malware payload (GuLoader)", "value": "4a91588b1979822f3cad1012615328adffd29bc9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709974105, "uuid": "a4a61f32-80ba-4d3a-8869-cb42c1c15c36", "comment": "Malware payload (GuLoader)", "value": "6e61eb80439afa4fc0353670dfb8756355a13a2ca5e5826655a24634143a0c6b48979e3673fd6a009a920f930a216cf2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709974105, "uuid": "56fc0e73-626a-4106-adc4-7d272b857dbb", "value": "T169D4F10EB10254A6EF61457B85A7AEB89F1F7E3974C2473253B0377C19732948F3A21A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709974105, "uuid": "187cb484-eac9-4275-9b94-c02ac9ebec79", "value": "e2a592076b17ef8bfb48b7e03965a3fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709974105, "uuid": "c635bef8-c638-4e86-86cf-536fe14dfe24", "value": "12288:B4mjiqrwQaKpIY+pGnLrTXhNGdtdN8ydQj9ELRVOwb5OgFMc/+:BTf9pmGLHz6XNRdq6LRVOeOgFMcG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709974105, "uuid": "1d27e832-eca2-4aa1-9943-4e387111f0b4", "value": 625856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709974105, "uuid": "c1c47f8e-7904-4862-8571-9a6b29655855", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709974105, "uuid": "87e052ae-4f5c-44d9-b589-1d6d9d2da6b7", "value": "Sandflugters.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e61d3482-ddfb-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RedLineStealer)", "timestamp": 1709978446, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709978446, "uuid": "d4e135ae-ab06-463e-8cf0-89f5aa766bb3", "comment": "Malware payload (RedLineStealer)", "value": "44b6f48a50be8b19b46773df9b712131", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709978446, "uuid": "82c489ef-3545-474a-ad58-84354b6a0c8d", "comment": "Malware payload (RedLineStealer)", "value": "38d43a3a1f0bda152fdd683184cbc79aee1ce6f422fe7ac3841a8b8a6cca1b3a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709978446, "uuid": "aa2c923c-e67d-445e-9453-c02a6cd022dc", "comment": "Malware payload (RedLineStealer)", "value": "e0a322b47ec2744abeda531092483f54c038faf9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709978446, "uuid": "d02840e0-bf0c-4acf-8d23-7149ab27addc", "comment": "Malware payload (RedLineStealer)", "value": "d716345882879fc34d60bb2a22fd4e2063ee96b873e40d902972eb59cee193096c96b2f2fcd4bccb67929117e44323e2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709978446, "uuid": "2e93ac30-07af-4453-a0aa-d232c4f23eaa", "value": "T1FDA35D2067AC9F19EAFD1B75B4B2011043F0E08A9091FB4B4DC164E71FA7B866957EF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709978446, "uuid": "24498e9f-94dd-4d21-a863-78573e3920e4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709978446, "uuid": "f478ddc9-0200-413a-ba89-fb2f7caf9e37", "value": "1536:9HqsIEq76ElbG6jejoigIY43Ywzi0Zb78ivombfexv0ujXyyed2jtmulgS6pM:91d+68YY+zi0ZbYe1g0ujyzdjM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709978446, "uuid": "0b4960e3-2f52-4c8d-b9f5-8eb4e2970c69", "value": 97792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709978446, "uuid": "f9402bd7-4bf5-45f9-bcb2-f27bb779d6e8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709978446, "uuid": "04c1772c-100c-4220-b129-bc15da205333", "value": "44b6f48a50be8b19b46773df9b712131", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "303ae150-de4c-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1710012930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710012930, "uuid": "604a1314-8cb1-43b4-bcb3-c1f5e83e7b03", "comment": "Malware payload", "value": "883c4cd416f0de2cd4c9bf60f35c0a5c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710012930, "uuid": "2eed96d8-5e08-43f4-97f9-899356764612", "comment": "Malware payload", "value": "38d8a5e41ff585143d35c0b088bd77e0cc1a8f11d2a521dee0ca03016d0221fb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710012930, "uuid": "0ebca48d-6bfe-4a15-a04b-5ecb1046ec67", "comment": "Malware payload", "value": "e4e074399cf3f6322b0eba5807741bfb4b0f135e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710012930, "uuid": "71b7fcf7-f540-4931-9877-cbffb5370fcf", "comment": "Malware payload", "value": "ad25b798739e46354996cda77de1b678cb6c83d0985cf55fcff914e3884d67682e5c6e120abe68f36c567199c18c4158", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710012930, "uuid": "aee8579b-0228-4c32-85d9-c4507761871c", "value": "T118266E0BF9934CBEC8F6D970525F957699307C6441253A3B6544DA302FA3F389B2EBA0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710012930, "uuid": "b440d61f-3aad-49e1-b161-f3531c248b71", "value": "98304:AiocVOM4Kw1mhfsS0bRW3VTJDSvzKPj1H:zolM4DSseBSLyN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710012930, "uuid": "fba65b15-47b6-4f30-96b3-90a80eb377a1", "value": 4656248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710012930, "uuid": "611fe0c1-f253-42d3-a6ba-3a5442ac637c", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710012930, "uuid": "5ca3a8be-fd44-4f32-99dd-f693668f419a", "value": "SecuriteInfo.com.PUA.Tool.Linux.BtcMine.9999.3454.10249", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9aa25dd1-de0e-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1709986480, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709986480, "uuid": "0af5a20e-7d97-45e0-a84e-b00843d3c913", "comment": "Malware payload (Formbook)", "value": "fa9c735362ff7f80aaff99822d4ce729", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709986480, "uuid": "d3c3b240-6edf-4380-8520-3030262d567b", "comment": "Malware payload (Formbook)", "value": "39266ae981b4d76e776a4a5aec29451bed77548d25a2aea51c25f29f7f72462d", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709986480, "uuid": "f5800662-f6a4-4dfb-b7c5-4a03e25c1e96", "comment": "Malware payload (Formbook)", "value": "8b7caa6cef997fe984d9b543c7e1ebddd6e2bc78", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709986480, "uuid": "be23c06f-c952-4ce6-8b07-2ef62b06692c", "comment": "Malware payload (Formbook)", "value": "fa5dea9b59f26b104723d191d21b5155c78e7ecf7dbacd87289fbdbf6fcbf2c8d1ad5e0e43203d5c12d9a74b8d936cbe", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709986480, "uuid": "63bf833e-6ed7-4309-a6bb-a2bac18d9bad", "value": "T18D35AD0273D1C036FFAB92739B6AF60156BD79254123852F13982DB9BD701B2273E663", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709986480, "uuid": "36206951-0ec4-4c42-a2b6-5357ab1f2988", "value": "afcdf79be1557326c854b6e20cb900a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709986480, "uuid": "b51b9f4c-6c33-43db-83fa-37c5667d11f4", "value": "24576:fAHnh+eWsN3skA4RV1Hom2KXMmHatrT7UNKm+XLm5:Ch+ZkldoPK8YatHINh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709986480, "uuid": "72c5c967-e35f-422f-865d-ce4deaf2271c", "value": 1117184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709986480, "uuid": "4590ba75-cbe5-45b0-b4f7-b411cfcfbc84", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709986480, "uuid": "810df34e-0221-47d3-8758-4b7b979e5936", "value": "D05285734 DHL.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "764883ad-ddf5-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Gafgyt)", "timestamp": 1709975681, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709975681, "uuid": "8bc1b72a-7480-4f14-82eb-0bacb3f24cd6", "comment": "Malware payload (Gafgyt)", "value": "46939486a280a8bcab8f769098220d3c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709975681, "uuid": "a84f2c54-4b60-4c37-88f4-9664a980b50b", "comment": "Malware payload (Gafgyt)", "value": "3934028abcd950afd830160756a70920db89aa31ccc7248f14130fdf2bf26fd1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709975681, "uuid": "2fbb60d2-4cf9-40b3-8d5d-beb3a91b416b", "comment": "Malware payload (Gafgyt)", "value": "e9bbfc82f2d7a8da4e1095d89a8f17fe9d708457", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709975681, "uuid": "9b6a4639-336c-44b0-aaee-1e9bb0f28e0d", "comment": "Malware payload (Gafgyt)", "value": "c415049e00c43a0e31807253abde912d41b9a5b9ed3aa5d0c69986acdadafba8570f8b160e651b0fc43b30d666d01ba3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709975681, "uuid": "339e8877-e06e-410f-bc61-bd3c67227cdb", "value": "T1F3439E23C9215F18D2999AB0B075CE784B53AA5093A71F7B6065C23C9443DDCF52B3FA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709975681, "uuid": "34a8c91b-da26-401e-98f5-754d964a5508", "value": "768:4m/m8J+WWjegNiQruQSelZznKH8JIazola2x/fCfn010fx4bzOtvN/hYLORmII:tmCWjeOldlRKH8JTElF3CfB4yN/xm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709975681, "uuid": "97cb55db-2ace-4739-99ee-dd20a8109d7a", "value": 55232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709975681, "uuid": "d3815eac-9b38-47f8-b748-a4d185160ce6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709975681, "uuid": "699744b7-062d-4d76-9a32-00fce68fcd8e", "value": "46939486a280a8bcab8f769098220d3c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98f4da3a-ddfd-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1709979175, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709979175, "uuid": "19421864-a271-45db-bb05-4e51419fa7c2", "comment": "Malware payload (Mirai)", "value": "ec51983a4f7dba90cf6a1d7a7e49633c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709979175, "uuid": "1b464bb7-3a4e-4473-a605-900e06287a97", "comment": "Malware payload (Mirai)", "value": "3a49680c1e2b573162e93121fb9c6cfc23367ed9845a1a72a98589ee6582755b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709979175, "uuid": "87a2ece6-d465-4b9f-9788-a3c353b08807", "comment": "Malware payload (Mirai)", "value": "e03b66a39b52c6a09a6f5f136fe6a87ecc2bf5b9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709979175, "uuid": "a312607c-ed61-4d9f-87fc-274869d5747a", "comment": "Malware payload (Mirai)", "value": "50ca59105fb4f34afb8fedbffa0e5c96b5838b352c8940411cec9b5beb1e07002db9a5c8c37cf2556e0d14eb85b12f6f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709979175, "uuid": "24f8b82c-5912-4b6a-bb3e-de8d768e3951", "value": "T12FD30945F8415F23C6D612BBFB5E428D3B2A17E8D2EE72039D256F20378B95B0D36942", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709979175, "uuid": "67b703b2-1402-4a7b-a4c7-6784ab9b7ac6", "value": "1536:dPTk45W6gJXa0BZkA8zPFuAewIP4VUNGqT+YYfAgHxGTUEF2ld0pwywAFG1lOW83:tTkesZk3zFui04MPaYYfAzwEzc5mj3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709979175, "uuid": "e118a1aa-52f8-4a4f-866b-e4a485b8b350", "value": 133888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709979175, "uuid": "c85ecc2c-4b9c-45ab-adbc-31588a45ba76", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709979175, "uuid": "9898114d-b0cf-4d83-a841-53310afeac7a", "value": "ec51983a4f7dba90cf6a1d7a7e49633c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b05a1b8e-ddfc-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1709978785, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709978785, "uuid": "127dcd50-f747-4036-9eeb-437016e93663", "comment": "Malware payload (Mirai)", "value": "bff78f27f0897c5bc7989080cb149c22", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709978785, "uuid": "6b602320-bff8-41a6-bf30-ac525837995c", "comment": "Malware payload (Mirai)", "value": "3a4e8721f11193f3c8c575eac6c546aca7f60c1b30bdd9e8212cf6ca69c06387", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709978785, "uuid": "8462c9a1-a414-40a1-b2d5-af08c603b711", "comment": "Malware payload (Mirai)", "value": "02d4434c55aff610ca880b5155dec74471d59b71", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709978785, "uuid": "a3d748e3-6038-4fff-be5b-f90d3a997cc9", "comment": "Malware payload (Mirai)", "value": "d2e93f11b1534d6b6179bb5f4e30735fe552367601867a5eabcb2b2e3973834d55c1d3698cb49b31fa3790263d91de62", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709978785, "uuid": "a85ffc03-ceeb-492d-958a-6125bcf6cea0", "value": "T19AC32993F800DE66F40AEA7605D70725B630FB720E531A7273573AA69E362E47827F41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709978785, "uuid": "72575c62-6808-4eb7-a134-86528bd1bf54", "value": "3072:VYZqpxJV8hVEwLL37EyH1o/y2YSJ3AP8ZSmvI0PDGnSQNER:VYZqpHV8hVEwP7DVo/y27J3+kSmvI0PF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709978785, "uuid": "95c0481e-0122-4f57-899f-25f87df20277", "value": 118310, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709978785, "uuid": "89591d84-db0c-4e29-938c-b11889c22bbb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709978785, "uuid": "1eb7c1d0-c7d6-487f-b4b8-8b24b3f83f31", "value": "bff78f27f0897c5bc7989080cb149c22", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c797f2c3-de31-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1710001587, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710001587, "uuid": "015331aa-0f1b-4e0b-9a71-1dcd8118073e", "comment": "Malware payload (AgentTesla)", "value": "b6e2581f84466b9ecd9b7640e267d091", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710001587, "uuid": "f338b81a-2317-4c98-94b4-c8f4e6010bb0", "comment": "Malware payload (AgentTesla)", "value": "3bd1401d752c9805d3fca26fd7ee5ee1b7368e96735b9a09b769a428e6d6dd82", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710001587, "uuid": "40ae8abe-1cbe-4754-8fb5-02b5169b29cc", "comment": "Malware payload (AgentTesla)", "value": "fd45bf9ae62f649909f97fff0ba2f08e1758e9b2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710001587, "uuid": "2e7a783f-a117-4cc7-82cb-9dbbd78470aa", "comment": "Malware payload (AgentTesla)", "value": "6b6a07e309b82cf22cb04ddd895131f8a5d05514495b99de367c0f24c79453de1ae0ce26303de04ac4519e5b103c34bc", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710001587, "uuid": "e5f0aade-5936-4964-b4ec-1f8bb73b68d6", "value": "T1AAE4127032FD9B69D2BE5BF8996061444FF2616B3812E38C4DE274CED9B9F418620B17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710001587, "uuid": "4a62ea6b-e74a-4642-af74-da5a67525bd7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710001587, "uuid": "dbba7570-9fce-4d17-9a7d-00c492f30e02", "value": "12288:lhKcFtImAFhU7/uyrm6eBPjkPbcjhQC3nudrvOw08FH6buYAPfzifsH:lhK061FhU9rm/PojSNudr2w08FHkRA3f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710001587, "uuid": "33f0d41e-3e12-45e7-8e7e-9d6da667079d", "value": 715264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710001587, "uuid": "17014db5-4ad7-4e71-93a0-a9cbbac5cadf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710001587, "uuid": "d5e5d251-08cd-447c-88e9-0f6a2a1922cd", "value": "SecuriteInfo.com.Win32.TrojanX-gen.20142.21101", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4338251a-ddce-11ee-b7ea-42010a9c0006", "comment": "Malware payload (LummaStealer)", "timestamp": 1709958845, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709958845, "uuid": "c949ae4c-6604-43d3-833f-524589ba3d07", "comment": "Malware payload (LummaStealer)", "value": "69c8535d268d104e0b48f04617980371", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709958845, "uuid": "db58025b-0525-4cc8-99d7-8925ca7cd0a6", "comment": "Malware payload (LummaStealer)", "value": "3c74e8c9c3694e4036fea99eb08ba0d3502ad3fe2158432d0efdfaacd9763c35", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709958845, "uuid": "cd431bd1-3a8d-40b7-a79c-8136ae0e9d46", "comment": "Malware payload (LummaStealer)", "value": "a835c367b6f9b9e63605c6e8aaa742f9db7dcf40", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709958845, "uuid": "fa900f7e-0c8c-4365-a67d-94fc4f64b276", "comment": "Malware payload (LummaStealer)", "value": "d07d7fae16da72b6dcefacd6e2a5c65caa33ca57694d8e470929ab3463b34b7d6ed8549336812840fba05649d227efeb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709958845, "uuid": "e3aad2a2-1ce4-481e-8cf9-bc4cccdd047e", "value": "T101641260EBFF26ABCA4D717440E2594502B8D34589A7B38B3C8C4428D777BE6E213BD5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709958845, "uuid": "7a0b1932-1192-4f3f-af83-3000e93bf9f4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709958845, "uuid": "27e8352c-90dd-4cb1-acfb-dc5c9ef07029", "value": "6144:dLZ7w3TYnYg03qDf//jmFiv+khfvmjFINtbZGdmiIH:dl7w30nYa7jGiv+kdv1nkM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709958845, "uuid": "a86c073d-ee39-4ba3-bda9-7e5436fea351", "value": 326144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709958845, "uuid": "ec4e548a-a164-4c14-9e06-c658df5a7d4b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709958845, "uuid": "9c960da1-3dda-4045-8d73-48f66ee4be47", "value": "69c8535d268d104e0b48f04617980371", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cea8f650-ddf6-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1709976259, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709976259, "uuid": "0b311291-a31d-4734-adc7-b75c2b0e7729", "comment": "Malware payload (Mirai)", "value": "45c47224d3306dc6acf13b96719ea128", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709976259, "uuid": "72a9557f-e88d-41e4-8bec-af94e3ba2351", "comment": "Malware payload (Mirai)", "value": "3d1cce5ae22328a6cb56d27ce98b8b7cdc961e39f50cbc4abdfe1d3a7a06f2a8", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709976259, "uuid": "1f3b1598-f272-4114-8569-ea0f3547799f", "comment": "Malware payload (Mirai)", "value": "97bd17151eaf5d9d7f9f96d84a986f1f3c6356b4", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709976259, "uuid": "108b3a04-7fd9-4757-9015-1ef396b9c692", "comment": "Malware payload (Mirai)", "value": "cbd52544de185e0237fe08d26b9da867b0071d5c50f56dd841e7ac9dba527a81e3629cf4e8c7a8be747dbb2ef8e9c161", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709976259, "uuid": "dd5c0dc4-585f-41b8-a5c2-a0640288788c", "value": "T107937DC5F243D0F5EC8705B15137AF379B33E0B91029EA43C3696972ECA1911EA16BAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709976259, "uuid": "ebc315fc-8e7c-416e-98bd-178380884186", "value": "1536:sUYl80AvyebhzEzASUr3JIaJi7M3gLkiNgKVL4GRUS3tkDNr7:sUYq0ovNHS43JIPIWkDKVEeBMV7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709976259, "uuid": "d240b4a3-3b49-4569-9fa8-822d56a3664a", "value": 89672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709976259, "uuid": "48c53772-ec1a-4441-85fe-3cb33ca2cdb7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709976259, "uuid": "4837363a-aa94-4b8f-bc3c-6b2783ce223f", "value": "vlxx.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8229732f-ddf5-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1709975701, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709975701, "uuid": "73e9ec6e-b03e-4fbb-8fdc-cb6fbdd0f040", "comment": "Malware payload (Mirai)", "value": "8d11a8f7b78c614b4dd68060c236cbec", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709975701, "uuid": "23142d0e-3fec-43d6-baeb-329bfbbf5f46", "comment": "Malware payload (Mirai)", "value": "3eb38688e0042206972a46023bf4883af11953306dc94bcd62d593803fc9556e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709975701, "uuid": "418733f6-ab27-4a57-a1a4-3b45f155502b", "comment": "Malware payload (Mirai)", "value": "cdc3435aeeb5c32b9e5f813f28924b0a7d1bd9ef", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709975701, "uuid": "d3e61bc0-afab-491a-bc74-d6662003d85f", "comment": "Malware payload (Mirai)", "value": "120de34ea063b6b03b79669fbdce72a3edd39673f9441c28171298eeaceadeb6515f6786a60d18e3f7bb7b1e87b4d98d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709975701, "uuid": "d58b9457-8c38-454d-8369-b95d1895c6f4", "value": "T1D3D34C46FA418A13C4D517BAFAAF4149333297A4D3DB730699185FB43FC67AE0E63602", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709975701, "uuid": "04a42bc1-c28c-496e-b6b9-959f054856ee", "value": "3072:ZgauByoyut54A17i5tmFz7rRUQ0IqqDHUAYM/9kwYj:mauB3yut54A17gmFz7r2QPHUXM/97Yj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709975701, "uuid": "e4860d24-1e6f-4210-9a12-3b13483624f7", "value": 136306, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709975701, "uuid": "9a19b5d0-2fd5-4d08-9ae2-07e6d38fb576", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709975701, "uuid": "f6cd46ce-7b86-498f-be7f-ddaade77fdd4", "value": "8d11a8f7b78c614b4dd68060c236cbec", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2dbe8c9c-de43-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1710009060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710009060, "uuid": "fd0dd49f-5c46-4573-8744-f3936a0f0793", "comment": "Malware payload", "value": "1402053b8b2c3df72aafca29f84d3888", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710009060, "uuid": "fbbb50df-3021-443b-936b-8b4c3e641e2f", "comment": "Malware payload", "value": "3ed124b33c8178e5e1972c8e89d3499ed17ff17a71acd3879172abd009f35ab9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710009060, "uuid": "55f25a16-1032-4e43-b396-222c12af2637", "comment": "Malware payload", "value": "5a910cc3f79ee48b44f257e35c98d43a2f729c49", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710009060, "uuid": "37f8c732-6be7-4098-aed3-5ea742e9c5f4", "comment": "Malware payload", "value": "5c334024439dbc467bf83e0e58ac1805a6b03ffdc7a5e7dbfc473e1bdfdaa4d36321e337143544ec2ba5830fec222e5f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710009060, "uuid": "61e32abc-03c6-4bb1-b8cd-69c7090442aa", "value": "T180F5338B9F24DD01C194A47DE62A3FBACF42C953AD5E4788033DCB56C9B2BC14E4B816", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710009060, "uuid": "5c893e81-d14b-4323-be29-93b1c3d5c974", "value": "2d0fc59cef3af8f955bfcba390045270", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710009060, "uuid": "cacd03bc-76c8-4165-966a-b0df15b59499", "value": "49152:6dQ4omSYtiblkFLMYzIcE1x4MjjYp30g0KKpF1cER3iRHFdAQupummsDLlhySYJd:uQxmb+SpjxB0NpF6a37uuR0JxF5+2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710009060, "uuid": "577d2af1-e988-4d43-8ae2-ec303ebf880b", "value": 3648376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710009060, "uuid": "76ecb8f2-c065-4c85-8188-b411655e81d6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710009060, "uuid": "646281db-f704-4c97-bd67-c0bdb9585129", "value": "getscreen-447141406-x86 (1).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f9655d4-de0e-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1709986354, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709986354, "uuid": "f18c9083-f316-466f-8cd9-ea6bf455c20d", "comment": "Malware payload (AgentTesla)", "value": "fb9f3eb16de0b085e745a9e98d8e05be", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709986354, "uuid": "2066ce86-5a21-45eb-8e21-9773b4a9604d", "comment": "Malware payload (AgentTesla)", "value": "413252bf1fb09a2b8d3fc1342c93fd63049b74cc651fa06630289e7c07e8a084", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709986354, "uuid": "c9003cf8-fa98-43ee-be12-94be1710acd3", "comment": "Malware payload (AgentTesla)", "value": "691c8b593919359517c042ec8d54f92c816bca88", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709986354, "uuid": "4533200f-2429-46a9-b551-23173704ec31", "comment": "Malware payload (AgentTesla)", "value": "a19ea48e7e5c0646f7e0b9c3c89ceaafec6fff4b6b87dbee2a09cadb240c1fd16679893bc3c962ffe3d90d914d6771fa", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709986354, "uuid": "6f9f1a17-8790-43ad-86fd-d3de40eeaa72", "value": "T1FDC5015433B84A22DA89D77358F25920D3ABEE57E3D6D30E14C475A82A357BECF03582", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709986354, "uuid": "8b09b117-d03f-410e-92ea-58b71c72bd2a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709986354, "uuid": "6b6c0636-8567-4459-862a-6eb11d8b1552", "value": "49152:7vcXEh5t9aPOBEVqEtKN0GXKq3cr/iIOLBbHJdcD4w8k:GEzt9aPO+oXtcr/iISrcD4w8k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709986354, "uuid": "9d92efe9-5553-498f-b872-6b186b756f96", "value": 2682368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709986354, "uuid": "996170c8-ca23-44c3-9949-f4a82e415e9b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709986354, "uuid": "6cda9c23-424a-403c-8a40-eeea32134e7b", "value": "DHL Delivery Report\u00b7PDF.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b7d8cdc-de03-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1709981649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709981649, "uuid": "7155f740-1573-4d3f-8676-12d5b1ca6a3a", "comment": "Malware payload (Mirai)", "value": "360df16b5f7f986cf676058657f8ee0d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709981649, "uuid": "99118c0a-5b0c-4835-b98c-54ea21fc6cd5", "comment": "Malware payload (Mirai)", "value": "429a93990eacbfc305e37bf26ffa67a8fd00efa0752d9df7f46816a1278904c9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709981649, "uuid": "b0bd1f13-213b-4f02-8777-35d6631954b6", "comment": "Malware payload (Mirai)", "value": "20338feb933be26da3f2dabccb4c569b25a54564", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709981649, "uuid": "fd06d5c0-36e1-4f15-bff7-0443ab54c91d", "comment": "Malware payload (Mirai)", "value": "7726d488c96d8acf75bc41f10d75c5f993a2f9fe8f22ca81dd0c123f3ce1e080a487679c3de71f5fb219782603b7a3f7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709981649, "uuid": "662a22df-7c76-4f94-a234-4711839f1302", "value": "T1C0E319D7F800DEFAF80AE33748530806B530B7E245925A372257797BED3A1991867E87", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709981649, "uuid": "3d4fce46-3c4b-40e9-9164-4098b1e73336", "value": "3072:eVIr+cghb7+L3zWPVnAsY0ZuvVrjbidL/5K+8yGXWiwyW:4IrtSP1AEZuoL/5syG3wyW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709981649, "uuid": "8398258e-da4b-4265-9308-4edc2f2fc0a5", "value": 150464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709981649, "uuid": "0fb4329e-38fa-4f57-8e56-f4e87b8c88b7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709981649, "uuid": "19bdd7e7-1d92-42c4-ae8a-232ec7eefcec", "value": "360df16b5f7f986cf676058657f8ee0d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a88ce44e-de37-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1710004112, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710004112, "uuid": "3c867070-3027-4321-8c11-89c26de6215e", "comment": "Malware payload (Mirai)", "value": "d6e8cb663c723c8185087225c84d70ba", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710004112, "uuid": "65d3bdff-4bbf-46cb-92ff-e5842741d46c", "comment": "Malware payload (Mirai)", "value": "43cb153b1a7a3d2ac14355f7b77ac9670eaf08e0b020e8c78f867e686de2c303", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710004112, "uuid": "d9f34508-aae9-40c2-9f34-68d8b676e9c7", "comment": "Malware payload (Mirai)", "value": "770db3c96b2b4a7cb2074d8ff161d03fcf70302c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710004112, "uuid": "99464890-adce-4abc-b0bc-97073a23f543", "comment": "Malware payload (Mirai)", "value": "d8d5fc6e61315132a82a6ad655b042e12db8df14c23d395e346a6d0344da37fc04a5758c8550c9fffe024243846e208b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710004112, "uuid": "d0caa5a3-6dba-450c-9829-133ec4ea3c8d", "value": "T1EC331981BC829502CAD413B6FA2E01CD332663A9E1DF7217AD216F1177DAC6F0D7B652", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710004112, "uuid": "282b3ca9-2ea7-4ef2-ae01-65cc77fe50bb", "value": "768:FTzl0WvB+cIz1dFNGd/GUWlVIKEb2vYubWUgPn+4X0Lw0obFQOlBNw/Ex3gRoO0Y:tzlxp+Pz/UWHIxQFaUg/9Aw2O3xQH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710004112, "uuid": "814ccb9f-ccaf-4964-8d82-9c44ea1339f5", "value": 54088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710004112, "uuid": "36b62e42-e68e-48a0-b82a-4dde7d7568c2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710004112, "uuid": "16b15336-8c76-4dd1-bde6-feb9a5f7c56f", "value": "d6e8cb663c723c8185087225c84d70ba", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35bc33da-de0c-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709985451, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709985451, "uuid": "defc0ecc-a86b-49d8-8c10-55fc99f5e441", "comment": "Malware payload", "value": "930ca341777115f0fc18b16d52a86502", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709985451, "uuid": "3302151a-f35f-4ae6-810a-47ff9f95d228", "comment": "Malware payload", "value": "4455ca4e12b5ff486c466897522536ad753cd459d0eb3bfb1747ffc79a2ce5dd", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709985451, "uuid": "9652d362-4c60-46fa-95ba-5daf729f4ae6", "comment": "Malware payload", "value": "cef9ef1bbbb0b80c21dd5c58bf68b374a194b35b", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709985451, "uuid": "3e74a1f6-de2a-4b70-908d-2cdc6fcc2684", "comment": "Malware payload", "value": "10928e84bafd2aa1f83ed38ce49ac891577e97f5e094a29ac9ddf9e92bcf936be35a72fad0023eac09d016a163264971", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709985451, "uuid": "7661f4f7-dbcf-4bbb-a58d-669be771686f", "value": "T1F93121151BE50719F3F69F76A8F7B6269977F84ADA03CD1E11C242084861700D129F7B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709985451, "uuid": "0803897f-a10d-4788-bab9-c287aabe6899", "value": "24:8v7JvbIrMZWRMuRHCCA26NvMHYdd79dsyozXozHfpo:85OKIA/M4dJ9UMbp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709985451, "uuid": "5b5c3238-3cc8-424d-b38c-28e609bd2e5b", "value": 1772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709985451, "uuid": "15739ae6-df13-437a-8b9a-1c488c297ef5", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709985451, "uuid": "5e7abbf8-bbe7-4955-9f0c-f9c410c83147", "value": "invitation-letter.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3701e88-de22-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709995111, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709995111, "uuid": "eddf075c-6377-4955-bbde-7dbfe9b5df86", "comment": "Malware payload", "value": "0e617b86ac8d0af23bc1e7a07baf8676", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709995111, "uuid": "266888a2-d6c9-49d0-89d3-2cf6ba571791", "comment": "Malware payload", "value": "47ce5263d8877f35f4525c8220e9f4839749539498e23d05caf6fef3b2e04a85", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709995111, "uuid": "8969b221-3cca-47e3-99db-5633fa0a6576", "comment": "Malware payload", "value": "9c4cfcfc4ffb263b2caaf0ac17a4757816845f64", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709995111, "uuid": "dc99731d-ca26-4f2e-b2bd-2e1b6ac3fb7f", "comment": "Malware payload", "value": "d96b905c4cabbf8c7d05041d0d8c806ab02743797abf01edb552019cf05a8569a1517f4a7c90267932eec2a1fecade14", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709995111, "uuid": "0d746d2c-a473-4b0e-b7cb-24dd1ef4b83f", "value": "T16FD53341B5C4C6B2D4A328335E5AAB654C3E7C206B648DCF6398550EDA363C06B36BF7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709995111, "uuid": "663316b3-31a6-4248-aaa8-c5b1f517347c", "value": "0ae9e38912ff6bd742a1b9e5c003576a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709995111, "uuid": "340bd81e-f639-48f1-85cd-c464708b1c1d", "value": "49152:bILp8YrZEYSE8f49YMQBH4iSMu9L+5Bl3uokxT8zNsGdSgPt1F3RCaFte1mEv3TU:bE8YruYyff3BYiAaBl3upxTcVL1eaF04", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709995111, "uuid": "3982f97a-2870-47d7-82a4-ec39bbf77af6", "value": 2989776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709995111, "uuid": "2e6a910b-6bb5-48e3-8253-071747a0cb3a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709995111, "uuid": "67bb128c-09dc-4fbb-acaf-6f5ef3f82938", "value": "SecuriteInfo.com.Trojan.MulDrop26.34016.31401.30875", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b953efaf-dde6-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1709969351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709969351, "uuid": "10a9cce2-4673-4bb1-90d8-76af59f23591", "comment": "Malware payload (AgentTesla)", "value": "904cbf760ceec25cd6ea08e34ffde380", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709969351, "uuid": "29463e8c-7bcd-4c9c-93ac-3dd6bcadeee5", "comment": "Malware payload (AgentTesla)", "value": "47da0229901192cd2f374b1f66436b349c2e12c27e353f5bf821bcb66d454569", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709969351, "uuid": "0e402226-fd13-4bc5-be4a-ee91926f6f60", "comment": "Malware payload (AgentTesla)", "value": "32afbfddfbb6f18a0d14f85218db08af8930e8b0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709969351, "uuid": "444191ab-f21f-4a36-b895-841881d1b31b", "comment": "Malware payload (AgentTesla)", "value": "5757f4d334249f85015173fd1806c4113f4e15894373730cf319d90266bad42217d7dc57ecbccc445833fbd8c6abcfc1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709969351, "uuid": "36db0e3f-2d0b-4d6e-86bf-e5aa627a5afa", "value": "T105D423E027B49461C4B733D7BBB59B8D6339A536E60AEC96960F8793B2CED440034D36", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709969351, "uuid": "4c121d2b-e947-4d41-9a77-f231a691d34b", "value": "12288:iSad0+l+1f23RTftqAxZ8dUgSgU0SKqlGJQuY4xfnIdFVvy10JzZHCWuXJ8+U:iSUzBz+UO3SKG5l+fS3NJdCXy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709969351, "uuid": "1b4f5968-6a05-489b-b50f-942fb4d7fe66", "value": 629884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709969351, "uuid": "27b219fd-00f9-46a9-a535-3edd2e56406d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709969351, "uuid": "0559df7c-0878-4598-bb80-7871fb7ec1d3", "value": "Summary of DXB,CNE & NE.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a362889d-ddfc-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1709978763, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709978763, "uuid": "b6d5abdc-870f-4464-a9d5-084ec7737e6b", "comment": "Malware payload (Mirai)", "value": "731a2745d8c857c276a67503d2d4ec1e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709978763, "uuid": "cc39c53b-3672-41ed-abde-9e7a02fbd780", "comment": "Malware payload (Mirai)", "value": "47f18b10bc7afc191c0dd21326da7591e1f7422f0c4279d91ff2aecc0bf97cd2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709978763, "uuid": "37277002-ae79-48a5-ad17-54d4857d1b38", "comment": "Malware payload (Mirai)", "value": "6e4a969458a50590fa97739a306dd3c0de37d394", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709978763, "uuid": "e45e7be1-8d68-4a82-b0dc-b6764c37f630", "comment": "Malware payload (Mirai)", "value": "d3e8b99497046bacd4ad4e2964af26b2e19e1c8d913b9d546535ea5699f083e6f1812dc39f577a5ad0d62e848135652f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709978763, "uuid": "1787bb3f-16cb-41b5-9a93-5fbc182b1a45", "value": "T1C5B35A73C8256F98C15AE174B0B18F792B63958182471FBE19B2C2B64483DDEF905BF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709978763, "uuid": "a92ce699-7da2-469f-8fce-bb46bd6d7893", "value": "1536:RaN/Y4/LqAge8miCcSFylwv206jz8/e5L076CaC7WCbo4lNXQUyIbCWlcHOV06fv:Rx4YeuF+GxD2bbcHpCWPpRZoj88", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709978763, "uuid": "9db4793c-047c-4792-87c1-ef568ed2f98d", "value": 117568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709978763, "uuid": "a8c6c9f6-8083-4331-930d-4fef60522c80", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709978763, "uuid": "5b1b73f8-03f1-42d2-81e0-52858b9aaeb3", "value": "731a2745d8c857c276a67503d2d4ec1e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73213f17-ddf5-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1709975676, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709975676, "uuid": "228edfe7-b47c-45fa-86b8-6d8c3f907f4a", "comment": "Malware payload (Mirai)", "value": "de7980176d4a9290222d61c28cf2abbd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709975676, "uuid": "46001ac9-45cf-457d-93ed-e16086203799", "comment": "Malware payload (Mirai)", "value": "48c5bc7a7d9e56ac6b52ee7ce01272436133693c7f58f778911fc8e604ed23e2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709975676, "uuid": "725ab881-4056-4a58-ba9a-c1f9cb00959f", "comment": "Malware payload (Mirai)", "value": "a23662bd31fff3d1402a24496b4f6a2d4a311cbc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709975676, "uuid": "4a5cfe5d-83cc-41c9-ab04-714065fb48ce", "comment": "Malware payload (Mirai)", "value": "f31ee291f566e276609cb2b51d5ac95f7e779fb4c1b2293c4387448eacfefdd6d5d5d66743fb3ba845c89a0903d7aa80", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709975676, "uuid": "ed9a10f7-59cd-4a79-87c1-af8cb79655df", "value": "T11BD2E111F1879BCBE16608F32CCF74950430BB0F2841A4E7BAA573270993F64166DBA6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709975676, "uuid": "d60b4087-a884-40ab-921a-f8d17226dd24", "value": "768:rd78ykw0/RCgm5dY+6GtVbZHFGH1OlhKMaEnbcuyD7UryqZ:57RLHY+5tVbKH16KMaEnouy8mqZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709975676, "uuid": "45b73ac4-a1ec-4e0a-bbb1-209d2427742a", "value": 29616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709975676, "uuid": "cfc952c8-9b2e-478c-9fbb-207a1ed5d12b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709975676, "uuid": "95e5a952-a459-4c4d-b08b-6cc842fa596e", "value": "de7980176d4a9290222d61c28cf2abbd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0332391-de19-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709991348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709991348, "uuid": "dbd92b12-8130-4ff7-b28a-6cbaa62851e7", "comment": "Malware payload", "value": "f64ace67fa66ca3c12057083f89b38d1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709991348, "uuid": "81bf0ded-f7a2-4c1c-92c3-d070d65b420d", "comment": "Malware payload", "value": "48f374bdc1e951c6d3920ff92da1ab49c973cf87499fb71d272dc88381e314e4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709991348, "uuid": "dbea4d60-a7f4-4696-bc81-bfb8367dab40", "comment": "Malware payload", "value": "9e157ba3909c88771ce55835123a009da7800af4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709991348, "uuid": "d1e43a5c-8250-4a16-9d56-8fd94f1ae5e7", "comment": "Malware payload", "value": "d6ec24e174445bfff08b9e37d942c1818b0dcc327f3f65c2763ae0ec61bbb5c875744efbc69d747aa4128599bd06526e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709991348, "uuid": "0def7706-7bc6-4222-ad7d-21ab3c72afed", "value": "T117D2F2DC35485F8FD14801B6C9B14B1239DBFBD395B774892A74F2A149F28816C309AB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709991348, "uuid": "305c2ecc-baf5-4824-be63-fff89ebb987a", "value": "768:vWNbsc8HC6DnN8StVF+XLFghkps4D94iAlU:vGwcWzNPQLzpsG94Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709991348, "uuid": "3f95f579-48d4-4c91-b6b1-e16bf0b82aaa", "value": 29450, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709991348, "uuid": "71fba90d-6aaa-4b46-ba92-c773ef3bbc44", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709991348, "uuid": "e03bf396-2e04-44a4-a0f5-5ddf47ee9507", "value": "SecuriteInfo.com.ELF.Mirai-GH.16970.17761", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c583f176-de0e-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1709986551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709986551, "uuid": "d66976a3-daf0-4e92-a171-968ba428c5c1", "comment": "Malware payload (AgentTesla)", "value": "074d73f9840941d0c41f51e808842bc1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709986551, "uuid": "b3400020-be70-49d7-b453-47072f36fe6a", "comment": "Malware payload (AgentTesla)", "value": "4ac52a72ddd3f981fd50ba526a4a21f3e4abec0e2189ff8c956094fe10bfab83", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709986551, "uuid": "5204bf10-a37d-479d-bd01-80b764485efa", "comment": "Malware payload (AgentTesla)", "value": "521cc6ee41f906f87c3d0b270a3f4d7965b6702f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709986551, "uuid": "ce58f4c7-eb81-41ef-9700-7f0775ab7f54", "comment": "Malware payload (AgentTesla)", "value": "3c587f5699c4bd715eff66a1d961aeae726efe826acf12bddf7fcb036ff13adaafa1bf235f9a2a9ef81af3cd5586e137", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709986551, "uuid": "968a2413-3c73-41fb-a122-37b22c1241cb", "value": "T1F8F4129633A81B79D1BB0BF7657211402376B51E8C61F69C4CD750CE0AB2F089B76EA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709986551, "uuid": "0c33c0bf-d1f7-43b6-983f-56410935d55f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709986551, "uuid": "6d70f09b-2d1d-41df-aa99-036afa725d2a", "value": "12288:IvnFtImAFNyr+uxiCkqjQQ30zGrJjHvvz0LcfLe5herRaVuHK9wc2HSSUk:KF61FalivHDGrpHvvh1RMwc2V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709986551, "uuid": "e151b757-8d4c-4009-a1e4-e1e4cc21c375", "value": 787456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709986551, "uuid": "b7301974-994a-4123-975a-84f7b4ad7b06", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709986551, "uuid": "078380d5-7053-477c-a45a-f4d6d90ea21d", "value": "Siparis TS210 TRTRP2 % Vat DIP No2561 PB 34870 .exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47e1ec13-ddbd-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709951551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709951551, "uuid": "39261e75-6e75-4a0a-9424-ca26506f6efc", "comment": "Malware payload", "value": "39cb9ca5666e1d72003c3be4e2414cdd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709951551, "uuid": "c2087eb5-5f48-40ee-9b24-2f82a6c8cfba", "comment": "Malware payload", "value": "4b251e612b2178729ee3948654529db3950e3cbe55904b7d9c207789d7d5a9b4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709951551, "uuid": "e2981498-091d-460f-88ea-c75251b1520f", "comment": "Malware payload", "value": "daa5976b81a9718c9c97e91c4d95893efe9ede23", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709951551, "uuid": "8ae964c4-5eb5-4c5d-bc9d-2c50296bbc09", "comment": "Malware payload", "value": "e66daf5ccc0720a362ee2ed3f809cd29d97d72577c7acfc5f01d7b8a42558e70b18e04e0891bbdde4b982714f038ea1b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709951551, "uuid": "2cbd7037-acd0-49ec-8f62-a2fd11414c6b", "value": "T1DAB5E03682D8CA65E210313D52C8B48724782DCDFBC9F6C6DAB5B8CE85FEE674125316", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709951551, "uuid": "f309f73f-1cc0-4a14-9d70-7fe0df22a78b", "value": "d879a65e465b1c412670e44fbe2d8e6f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709951551, "uuid": "8d62885b-088a-490d-9b81-223a723723b0", "value": "49152:cbrmcFtcE6HVxKfArteUp1k0UNPHKXBn0gK1QGpp4D0Bx0KY8D2kwU3+t2y8w:c/m0t7HArteUp60UNvYBn3UQGp1BhpDI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709951551, "uuid": "ea740b5a-69bd-4f45-b9b7-a2311b70ef73", "value": 2418440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709951551, "uuid": "0fbc37c5-5981-4380-a3d1-fd691cd5c081", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709951551, "uuid": "a30d38f7-db22-4e57-bcb0-434f0cf9048c", "value": "SecuriteInfo.com.Trojan.Siggen22.10132.8224.3522", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "caac54d5-de37-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1710004169, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710004169, "uuid": "ded7ca9d-a2a7-4aaa-b057-9971e9700ac3", "comment": "Malware payload (Mirai)", "value": "ae4f97637fbb2015afa979abb4ef85d5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710004169, "uuid": "a55aed12-73cb-49fa-bcc5-cde0036305cb", "comment": "Malware payload (Mirai)", "value": "4c4c0963d8781d47afe84f41633abea72ce0f2d606553ae546bfcdc35b2054b6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710004169, "uuid": "f2b0ed93-8b6a-48f9-a787-d8465d440950", "comment": "Malware payload (Mirai)", "value": "9fa09b32802375e3b914884cd12cacdd9e731fcb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710004169, "uuid": "9dd8916e-d351-465b-9636-64356ec976ca", "comment": "Malware payload (Mirai)", "value": "2a28832b0ddf30f7b026a31895dcd41cfc04e7dfe8f237acfc39d4c328efc9ec5f4dab9446926114d2dac893f79e609a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710004169, "uuid": "bffb3aeb-69a3-47cc-ab65-446db3ea5a24", "value": "T1D343C652B8815A6BC1E423BBEA6E518D3371B3F8D1DF3616CC111B24778952F0EA7B81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710004169, "uuid": "a7488f74-f2b1-4a9f-a649-432c846d9c2b", "value": "1536:Jk48ZOlDxbcYfiQ125+XDW+rd8ea0ClG9WkQxgd42+:x8ZKut4DW+iea0OG9/Qq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710004169, "uuid": "c83a2413-c1ae-404f-8050-f41ce3531ab9", "value": 55612, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710004169, "uuid": "a4cce5ee-6a50-43a6-80d3-4959a9cec19a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710004169, "uuid": "5bc59570-af8d-493f-bb68-ce3e011163f8", "value": "ae4f97637fbb2015afa979abb4ef85d5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8a839f2-de38-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1710004622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710004622, "uuid": "9457ffd8-92ac-4bbb-86b5-84ce95893c0a", "comment": "Malware payload (Mirai)", "value": "121802fa5cf9bd888ec52159e5477008", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710004622, "uuid": "0e75d68f-4340-4ecb-9308-4af9d185ca27", "comment": "Malware payload (Mirai)", "value": "4ce482df82ee49466dab664397f21a8c45a1f731471c5fc3390b1d827724317f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710004622, "uuid": "5b8289b3-3b31-4aca-9765-1dbdbd6066cc", "comment": "Malware payload (Mirai)", "value": "c584f08e9890617e5c40215201c6be5323c58b34", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710004622, "uuid": "a2697a9a-add1-43fe-9845-e0e794854f22", "comment": "Malware payload (Mirai)", "value": "f1f07d04bc09535c5304b7b41c94840a1655846ff3d672ee7e6bb0818a57f98ef48416e212d80d0aa1b5a2db863457f6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710004622, "uuid": "e12e0aa5-bd19-47cf-8493-6f25fd93af38", "value": "T1A0335A21E9791E27C0E0F87A62F78728B2F50B0E25A88A5E3D620F4EFF215D0555B1F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710004622, "uuid": "94adac62-b947-49c5-b157-0740a9446af1", "value": "768:k79EuoM+fq9SsZdSSPTfroYz7cYo2TAPKOO+hdm7FaR:89EuIfSSsZXPTfroYzgYok8h3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710004622, "uuid": "2ec2dba5-14f9-41e8-8bc8-6c0174b8f9a4", "value": 54716, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710004622, "uuid": "da4a2ada-330c-4638-b703-f53fca70eb76", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710004622, "uuid": "d9359ed3-296d-41a6-8c28-10faeba0c743", "value": "121802fa5cf9bd888ec52159e5477008", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c513fbcc-ddf1-11ee-b7ea-42010a9c0006", "comment": "Malware payload (GuLoader)", "timestamp": 1709974095, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709974095, "uuid": "75f50127-2fb4-4204-8db4-3cc252fe347c", "comment": "Malware payload (GuLoader)", "value": "db3717aeb77bbe328fe74b47e5b0d0c8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709974095, "uuid": "add5ec7e-5f2b-417e-8ca2-5342b79754f6", "comment": "Malware payload (GuLoader)", "value": "4d1f9014c85c231c712b6a18dc12245f1717c39c15eac22c48fb3c599fdb9288", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709974095, "uuid": "69056aff-5bc9-48cd-9ede-973e4f1b6b10", "comment": "Malware payload (GuLoader)", "value": "75f66ad402faaaa23678b2a0a9b91613bfca6c42", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709974095, "uuid": "fc0df8dd-d1c3-41cb-a2e7-bdffda01bd86", "comment": "Malware payload (GuLoader)", "value": "b511f8baeebd4226244f5cf0eb6095e9d8da7f9cb867ca9a240876ef2a94bec970b7fa961ec43ea1873a652ea78e0425", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709974095, "uuid": "6191f776-66ca-4e39-90c8-d831d0800432", "value": "T1D7C4F14EB6419595DF65023789A7AE74AF6F7E3C71C2473213B03BBC18222949F3D21A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709974095, "uuid": "a0e941ef-63a6-41a5-93c3-d49c19894e63", "value": "e2a592076b17ef8bfb48b7e03965a3fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709974095, "uuid": "41557433-79ed-4902-8a1a-71150bf98ae9", "value": "12288:44mjiqrwQLLJKpoeaaoTtQ0by9839ELRVOwDMc/G:ITfLLMpoezoBQSqo6LRVOQMce", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709974095, "uuid": "63e27b6b-c745-45fc-ae1f-50acd5c8f24b", "value": 594296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709974095, "uuid": "78f3f775-ede3-4419-b7e8-f098d1f221da", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709974095, "uuid": "5e07dac7-9fc7-44bc-ac06-0434f6c54287", "value": "Afslrings.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b72a678-ddf5-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1709975636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709975636, "uuid": "a85cf88e-b755-4cc5-9177-eaabaaaeab08", "comment": "Malware payload (Mirai)", "value": "2f4eb38f04d173ec127b65ddb2caa438", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709975636, "uuid": "c2831c2e-7e14-4085-8cd2-7cb17c88bca5", "comment": "Malware payload (Mirai)", "value": "4e2666ff6edd6f6bc49d1fcf8c804a64516aabde2ae563fd4e16e541aa8dd662", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709975636, "uuid": "a1fbc792-d082-4748-b1e0-7b892b666fc1", "comment": "Malware payload (Mirai)", "value": "86c64d9c915fb2233ab27c7150e521a048b125f6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709975636, "uuid": "81444ab2-cb5c-4b30-b74b-fb6f48b1f93e", "comment": "Malware payload (Mirai)", "value": "bc8bc5392253560416353745afcabaca94184367facffe995c73d934f0007c177b7c4b8e691bc0b66f0de96fb603d5b2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709975636, "uuid": "b8d5cd61-abb7-4671-8bf4-5dbddb1bc40e", "value": "T1D6E37D32BB254E37C0E5953841FB4736B7B64BC52670520BBA618F9C3B1AAD031937E8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709975636, "uuid": "c2639c05-4f20-46f2-9ee6-1671edaf4035", "value": "3072:C/Yt3iJ/clI0p1+WnmxDc2mQSV3NRmfgMTBL:C/YtSG2efmxDcw6RmfgMTBL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709975636, "uuid": "a48bc1eb-7550-41af-97db-30cb57d715ea", "value": 147516, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709975636, "uuid": "16617de0-0861-4c87-a2b9-91be56debdc2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709975636, "uuid": "f47f0ec5-6843-4b94-a6cb-669a110952aa", "value": "2f4eb38f04d173ec127b65ddb2caa438", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8157992f-de11-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709987726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709987726, "uuid": "fc6bbe6c-d119-4f7e-91fb-c37f2f8a9e61", "comment": "Malware payload", "value": "2d2ecfeb92283dd0dd136e51befd4d26", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709987726, "uuid": "5549e50a-ccc7-4361-9bd7-b49ee73aab4f", "comment": "Malware payload", "value": "5023f9692aa352be1017aaf5f0a019f9bc14c5a667ef48a78a592b3ee9015bbb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709987726, "uuid": "85891545-401b-4a10-b48c-45f7ae16c155", "comment": "Malware payload", "value": "8dad5121a48bc7e422a73ad39dc1f5930a513b55", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709987726, "uuid": "84f67db7-47ec-4e99-a0ad-f2a80870cc68", "comment": "Malware payload", "value": "b6d15491414b141d94f9716a5aa18d4eaa89a5da0b87ddaa0615f600181b11e9f1948845278d6a941b24f48a8061386a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709987726, "uuid": "49e74282-07cc-4042-8c92-502901a1a277", "value": "T1A5C5338B2A05D298C056C3F039BADE33E467A0C25F8AC5E78DEE866DD5C16D58C7C583", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709987726, "uuid": "a31fbd91-0b80-4bcc-9e1f-7eb9e26b6b9c", "value": "d5ee67a5d17ebe4b53d6509020438cf2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709987726, "uuid": "94ea8082-4101-40da-a993-c9a46ab2b40c", "value": "49152:AK3NI19TnNRRH7G7IXyBxwzH7mUSjpJpzsQFv+rtcVeIjzz4sSIfdxU+:NIBtHfXyBxmXYF39+rtcVeIPxXd++", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709987726, "uuid": "3c2b19de-d0b6-4590-8d8e-3ee40d5ae192", "value": 2674456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709987726, "uuid": "9e20fe07-390b-4305-ab49-8e6f6eb3b4a7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709987726, "uuid": "423fc1c8-abef-45d7-b5a2-fe2d7e8fd450", "value": "SecuriteInfo.com.Win64.Evo-gen.6435.14123", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef97bdfd-de19-11ee-b7ea-42010a9c0006", "comment": "Malware payload (CrimsonRAT)", "timestamp": 1709991347, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709991347, "uuid": "93f7894e-e6a9-4575-a3b3-1be76ca94c0d", "comment": "Malware payload (CrimsonRAT)", "value": "55b3cfd78d9e2624d769acdfc5522753", "object_relation": "md5", "Tag": [ { "name": "CrimsonRAT", "colour": "#D90F59", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709991347, "uuid": "957bf81b-8caa-493b-9df6-876caf939aea", "comment": "Malware payload (CrimsonRAT)", "value": "504c7549caa901ca24a04915fe221236b3f41c947c7857c9d4634f3dbe31592e", "object_relation": "sha256", "Tag": [ { "name": "CrimsonRAT", "colour": "#D90F59", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709991347, "uuid": "a23f46f4-5f47-4566-b0bf-b5496df6abd9", "comment": "Malware payload (CrimsonRAT)", "value": "38a7f5b0ca7f508497bbfb42d32184b001367308", "object_relation": "sha1", "Tag": [ { "name": "CrimsonRAT", "colour": "#D90F59", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709991347, "uuid": "994f70a0-67b1-4acf-a2ad-be36008e3217", "comment": "Malware payload (CrimsonRAT)", "value": "a992c2981b0e64c9a92f489d95b2aaf2286d4c9d265d0f6048e3ecb4f3e300c5283b7d3d74721ed7a04da1b20df68723", "object_relation": "sha3-384", "Tag": [ { "name": "CrimsonRAT", "colour": "#D90F59", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709991347, "uuid": "a6d7480f-0619-4e08-a733-a8a51566d38b", "value": "T1FB0744756130925FC900F81AC7FD650BB5A2BAD8C829E07EE059993E1533E3B574E3B8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709991347, "uuid": "51841711-19b5-404e-9a98-c87a1866299a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709991347, "uuid": "f1956c4f-dc46-4169-b84c-517399c85a57", "value": "768:eaQjTpc2IVZM23zLnh8nLZ7FLOMaabW8FqZRGT7O:ZQjTpcpZM23PhqLZ7YmxY7c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709991347, "uuid": "29cb37e8-b344-4f34-99d7-e1a300857101", "value": 17739776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709991347, "uuid": "69d02d8c-ddf2-4e0e-b9db-5d4104b7a613", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709991347, "uuid": "8e27ac67-7c86-45a5-9f0a-d866699ff5c2", "value": "SecuriteInfo.com.BackDoor.CrimsonNET.14.8459.4902", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5ea6419-de30-11ee-b7ea-42010a9c0006", "comment": "Malware payload (GCleaner)", "timestamp": 1710001101, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710001101, "uuid": "2e0e2938-d28f-4265-b631-754b978db021", "comment": "Malware payload (GCleaner)", "value": "d7a8d0ada2565dbc31293ce1d3a59470", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710001101, "uuid": "c28490fb-d731-4290-a15a-ed648bc54e72", "comment": "Malware payload (GCleaner)", "value": "508e67f9f8ecec59538cd61fc6aaf0c25b4194d6dbd8b830f7b5bb2b8adf5ae9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710001101, "uuid": "ff916874-fd85-4e96-aae2-cd573560ca50", "comment": "Malware payload (GCleaner)", "value": "a7bc1a8f5975a99949e8fa075221183d464c0714", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710001101, "uuid": "de38f1de-7757-46e4-8631-fb3bfc0b8db1", "comment": "Malware payload (GCleaner)", "value": "2157833088dc58de8f75a1f2a079c9407403699b95603e71b0adc2cbe63763255c5dcf4d871251b880d9c73da1d81789", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710001101, "uuid": "83e6e94c-e0a6-489e-a363-7ad88e37be22", "value": "T1FB34F01235E8EC70D9F20A3459B5C6A6197BF853673041CFAB943A2E2EE27D15E34327", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710001101, "uuid": "17d0c349-e76b-49cf-b070-01dc662517e8", "value": "aba6a204b06fee0be8fb6aeef5a4c030", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710001101, "uuid": "a810d358-940e-4837-93c8-2e0fc5f7f60c", "value": "3072:nijYQAMaMbfYAgVotVdHEn4b+4WFIyqxmf2HwUFCJijtzJngkZkDI6ocxf8a02:nijF9BlVdkoEFIy5OJzBgkZk8jcxL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710001101, "uuid": "c9052cac-9ef9-4933-9914-a6957efd51ee", "value": 244224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710001101, "uuid": "11a8a8d8-ef13-4d2e-afb6-51be5d0d7ef2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710001101, "uuid": "fe7b73b7-71d2-4c75-9dc1-3ccd3f01832a", "value": "d7a8d0ada2565dbc31293ce1d3a59470", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "620c3416-de3b-11ee-b7ea-42010a9c0006", "comment": "Malware payload (BitRAT)", "timestamp": 1710005712, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710005712, "uuid": "fe66799d-3b92-4b3b-80e5-dafc5667520b", "comment": "Malware payload (BitRAT)", "value": "4adcf3b25fc1e5194ed8610591036f12", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710005712, "uuid": "23d2e5c6-d073-4b5c-9f04-9720e3af4236", "comment": "Malware payload (BitRAT)", "value": "518e36189de0efd524a3d91bf2683b9d676e3638d8d81d8e37797eca863815dc", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710005712, "uuid": "84cebba3-4bcf-447d-b883-50d9dba74de9", "comment": "Malware payload (BitRAT)", "value": "23c738342205fecc7d8f5c7316a861f07b0e4922", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710005712, "uuid": "fb1fa8db-a62c-438f-8d99-8934509811ca", "comment": "Malware payload (BitRAT)", "value": "3de6364591e03ac08515cc0e9984f3396fec2c9e37eee320e49076440751b7f962e1a1e9073420550408dcb3b3c2d2ba", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710005712, "uuid": "8b3f85aa-019d-4a6b-a4bd-021f6611b005", "value": "T101221A1527E8837AC6B64BB76CB392500B70E7469827DFDE3888601F9D537804B66FB1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710005712, "uuid": "2997e71c-014c-4637-b60f-fc6f13249ba3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710005712, "uuid": "6f7e10f3-fce5-4fa7-89f7-73007ea027b3", "value": "192:r+BmQx19wX6KpozKteihCilpDvUYTLpFeGKzwHV5:rM3COmQiUilRNTLreYV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710005712, "uuid": "1cfb8f95-fc34-4af3-9ddb-b80c3a88dd95", "value": 10240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710005712, "uuid": "a84520ff-607e-469e-9c32-fa415d1476c7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710005712, "uuid": "dded1dc0-4e5b-49f1-a1da-7393f22edd13", "value": "4ADCF3B25FC1E5194ED8610591036F12.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d7a6f6f-de0c-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709985437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709985437, "uuid": "fb2e3fd4-f4e8-4cb4-8e1e-bdf70b3a5c89", "comment": "Malware payload", "value": "8f30571821fb807faee2caeac75f2983", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709985437, "uuid": "b6287e32-93d3-4141-861c-bb42370074bb", "comment": "Malware payload", "value": "51b5b24ce87dd44bedec7484a088e52ab4c54d3136355cd0e872ddb1e51bfa7c", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709985437, "uuid": "822be2ec-6228-4313-8fc6-98018362ed02", "comment": "Malware payload", "value": "293cd4873e5189ddde485786586d5b9367ba4da0", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709985437, "uuid": "bc5b8d7c-949b-4c0c-bc30-42535834d01a", "comment": "Malware payload", "value": "e629fdbccc764630c5b9ddf3f9f88ee9711ccc539f208d73f90aabd8a65d7d0f428ba6a7bfc5789be50d345d2215a1dd", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709985437, "uuid": "f5275d30-1d1f-4bb5-ae72-9eb43de441d2", "value": "T183752BF4B2917BE60FB4195DB38F80B22C27B857F0BD5ECA62561A4DC684248D5F6CB0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709985437, "uuid": "98920d0f-f6cc-4fab-bcd7-fb1527f4b7b6", "value": "24576:15iiDPOWzmuGF0jBBiNB/7R5yy8X1Z1XT:Qn4BBEylZ1XT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709985437, "uuid": "899ac590-2a49-4fdd-9b00-aad24b8f816f", "value": 1664087, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709985437, "uuid": "c7178b42-1f0f-4d56-8b01-a68d7393af68", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709985437, "uuid": "2a19d7cc-c372-4571-b22f-8b619b571311", "value": "18401195551524611044.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2924285e-de45-11ee-b7ea-42010a9c0006", "comment": "Malware payload (DCRat)", "timestamp": 1710009911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710009911, "uuid": "12efc099-c197-4e76-9c2e-0cd30d8f91ef", "comment": "Malware payload (DCRat)", "value": "53caa7a9a4d652faf58f633b9b0016b2", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710009911, "uuid": "75568e3c-5ca0-4d2a-8629-3a8fa7350a04", "comment": "Malware payload (DCRat)", "value": "51c56e404a2da658dc429d8977bab338b7729aa543df31bbd39dec04c4367c3b", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710009911, "uuid": "4ac8e852-0260-49b4-983a-b93c8c9924b6", "comment": "Malware payload (DCRat)", "value": "09a44b57173f2c69e497defd6d1a184090774d5d", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710009911, "uuid": "4c63834c-540b-4817-83e6-52eefcea8fdb", "comment": "Malware payload (DCRat)", "value": "847aa9be3d66cf4950d9649b0216753a5c857ca137e96450f12a81d3d93b8c3c9096913bfe3f0330ef5d590c14d28155", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710009911, "uuid": "060b09d8-91d7-4fc7-8521-67db009e98fb", "value": "T1B9263302B6D5C1B1E4731A36576093A22A3C3C651F25CBEF23ED686CD9740D2DA317BA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710009911, "uuid": "c7158d9a-d6f4-4a7b-aac5-bd72c40f49ec", "value": "75e9596d74d063246ba6f3ac7c5369a0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710009911, "uuid": "ce9b460f-6c25-48f4-b5e5-543de89e2e9c", "value": "98304:2sL8OJ0sThJRnua26MlCvfUOUrRAHmqPSXRuHL1rS7MMkFtULmM+Z:18OJnbRuayo3BESG8ShurJFtZZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710009911, "uuid": "50bbc9cb-392d-474e-9801-6abdc0b8aa32", "value": 4493259, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710009911, "uuid": "e092a57c-b1fe-452c-b196-66604ba591d5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710009911, "uuid": "a284b0ef-61e2-4956-99e5-11ed7bedee47", "value": "53CAA7A9A4D652FAF58F633B9B0016B2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eaec0db5-de37-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1710004224, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710004224, "uuid": "18222cd7-5608-428a-80cd-b73afec5f4f1", "comment": "Malware payload (Mirai)", "value": "49558d0895064f298f6af3534453c722", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710004224, "uuid": "758451b7-ea11-454f-a46c-da834c5ed1ee", "comment": "Malware payload (Mirai)", "value": "529773fa918a730e04cec7f5de9162d9fba6af5d0240b9d91e0fc087094b276e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710004224, "uuid": "66f2d941-2176-4a3b-b8a0-fb343de8da9e", "comment": "Malware payload (Mirai)", "value": "045f8f98f02d89220074edfddab68b64922bdb5b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710004224, "uuid": "0f0c4aca-d891-47ed-8cfd-5ce28939432c", "comment": "Malware payload (Mirai)", "value": "16aa9917b8a589025be0f675cbcd07387f99a64a0dfbdd2c8b766312bde5ca883f3f30d5854418555daa69cba4308b98", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710004224, "uuid": "a6b382a4-1ab6-4476-bc9c-d9bf465f3289", "value": "T1E8338EB3C42E7D94E249D278B9204B385B23D40695933EF5974AC6978047EECF5193F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710004224, "uuid": "b3b92b98-1ca3-4b1d-b1b2-8ba96959373c", "value": "768:D3/zzfp4N2D65lLsJaLwtAK7wRvqdDoZnFkaFgll0aeC74OKCVkomnoC0LNE:D3/Pp4auUaLwtA1So3keSia/KKYoC0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710004224, "uuid": "d60f9aa8-6bfc-4c0d-922c-b0e08a93f697", "value": 54676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710004224, "uuid": "1e131eee-9a7c-44f7-8173-797400ffd74c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710004224, "uuid": "15650a74-8c7d-40fe-8d10-ca5f0b689d2a", "value": "49558d0895064f298f6af3534453c722", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1e132ec-de36-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1710003806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710003806, "uuid": "fb3aa542-e878-4bc7-a8af-6e2d29e7dbfa", "comment": "Malware payload (Mirai)", "value": "d0854303df8e1167af5fe04c99e82479", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710003806, "uuid": "8fa506d7-d4fa-461a-b441-31f02b6a10bd", "comment": "Malware payload (Mirai)", "value": "5382ad9f54507e1acd1b8dd0c94d19e76657e74908ace4041ac3510e13ddf49a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710003806, "uuid": "704b38d8-d6b4-4fe6-a701-94635da839d6", "comment": "Malware payload (Mirai)", "value": "b548c98003cce832f0e8d5399f611a9c5f209374", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710003806, "uuid": "7bc7f6f2-a012-410c-a750-8c3265eefd03", "comment": "Malware payload (Mirai)", "value": "51637c45e67d5649a4f0c14590a1faefd2538de48726338a88670c5afd60e8742e0a5caa057d3f1f26d5f39f9dc42cbd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710003806, "uuid": "17e82895-298c-43bf-8452-94fe1b073663", "value": "T133F33A46E6818A13C4D2177AF6DF424533239B64D3EB73069928BFB43F8679E0E63605", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710003806, "uuid": "512603c9-bbdb-468c-9dcc-023157d34e71", "value": "3072:EkMU1+pwC9TQZaOWSesFEASGhr5WmUyvOh/mCGM/90L99z+:EkMU0pRtQZaOWSesFZSYWtWOh/mrM/9L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710003806, "uuid": "f4ad82cc-769a-44f7-8fa0-8f4d6a89be3d", "value": 157314, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710003806, "uuid": "2f9bc7ac-6ecd-47d1-b964-8253176ce8d3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710003806, "uuid": "21eec745-bbee-4585-8c78-4970b9fb991d", "value": "d0854303df8e1167af5fe04c99e82479", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2104011-ddcc-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RedLineStealer)", "timestamp": 1709958253, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709958253, "uuid": "6abec63c-d866-4ea6-8dc1-0e377f1695d7", "comment": "Malware payload (RedLineStealer)", "value": "1f22a7e6656435da34317aa3e7a95f51", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709958253, "uuid": "69453a63-6451-457d-a5f1-7c1894961291", "comment": "Malware payload (RedLineStealer)", "value": "55fbfaaeee07219fa0c1854b2d594a4b334d94fad72e84f9f4b24f367628ca6c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709958253, "uuid": "186845c0-f867-4b36-b26f-b81fe20ab061", "comment": "Malware payload (RedLineStealer)", "value": "8bec84fa7a4a5e4113ea3548eb0c0d95d050f218", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709958253, "uuid": "b5a8cb0c-a61a-4817-8434-a6f53b0b4385", "comment": "Malware payload (RedLineStealer)", "value": "f49899097a7bbfd49eb24cf6f55896835476e123075551200e57fdc3b03d3463129f1b15f706478e690eddb3366374a8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709958253, "uuid": "26a69a16-1b5d-4a00-99eb-8263723023e1", "value": "T1E364E72462D6EBA2E2CA03F1C87984FC4776CD54C083D35F58A4BDA67F327A4D7118A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709958253, "uuid": "db17147f-5bdc-4c0a-9610-4128ce165cc4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709958253, "uuid": "3fcb98f7-54f5-404c-b630-581c247ffd0a", "value": "6144:LtaJEzrozDSV1dNaYO5/Mdk4KwqjDNgxoUb2dME:LtaJL61dN/3K1jJfU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709958253, "uuid": "613659fb-4ef0-4e8a-a44f-45686af64031", "value": 317952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709958253, "uuid": "0948cd7e-27eb-44fb-abc2-d6d6a6a2373e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709958253, "uuid": "20a7e10f-7ff0-4a56-ae98-6bd8c6473b2a", "value": "1f22a7e6656435da34317aa3e7a95f51", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba45f157-de37-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1710004142, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710004142, "uuid": "fce4165c-2270-4769-9f6f-549e9e9fec86", "comment": "Malware payload (Mirai)", "value": "fb97fbb38d93ab62a76cae94f295cf00", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710004142, "uuid": "8b2fa213-e389-4d83-83cf-25ced4177265", "comment": "Malware payload (Mirai)", "value": "56b850141a2e5f24c67ab554c257c35b001c24ba351602bf03752f6fbb594820", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710004142, "uuid": "dd541216-06fc-4c17-a23e-f8b6a1423896", "comment": "Malware payload (Mirai)", "value": "a6ab02a1b66534261182f7f194310cd2fa020d4a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710004142, "uuid": "b42f5138-c96e-4000-a6f0-8ab7e2ea0de0", "comment": "Malware payload (Mirai)", "value": "c30d22263d1c26df2a71a5fd783856260e895545531a4c959e5ca4f6c9ba4ab4eb508a2a512b6544ccbbc8d0b59dd845", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710004142, "uuid": "ec3456dd-0a7f-428d-918d-3b99e9e80f17", "value": "T1313318D6B4019E7CF95BDFBE80224909FA21625251930B3B23BBFD936C322A58D53D47", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710004142, "uuid": "08ddf186-e5ec-4666-b905-522f97c0a0c9", "value": "1536:zYutWMN1XFblQJi2h1HQrQCHTnJ1/iVP539j8K:k0rl+iHrQATMP5th", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710004142, "uuid": "9483c46b-de1d-4762-85cf-02bbec023923", "value": 52492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710004142, "uuid": "5409c720-74a9-4463-a00c-f4f3b2789bcd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710004142, "uuid": "ab79de90-f59d-4acc-a881-24192df7eb10", "value": "fb97fbb38d93ab62a76cae94f295cf00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4252b8d-de37-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1710004132, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710004132, "uuid": "8ec375a1-14ff-4e77-aec8-2cb82bec9851", "comment": "Malware payload (Mirai)", "value": "42e94f14dddad4b7ca68fd779b321e33", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710004132, "uuid": "7fa4be3a-dbd5-4eb2-b3c1-f1e3c0812046", "comment": "Malware payload (Mirai)", "value": "56d8f2334961e08d2567f736058753a7023fdf8de2096100ec59c186fffa20c7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710004132, "uuid": "f9f73823-09e1-473e-82ca-714897831515", "comment": "Malware payload (Mirai)", "value": "da5f58e3dfbb2a814681d524c32cf9378e138740", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710004132, "uuid": "3732217c-cacb-4322-a185-d9953a6c2472", "comment": "Malware payload (Mirai)", "value": "1419884807c0f660446133d0618c314ed0f73c4ca7bcf955090cfb1df74c0b81710b1639a44c3235842cf25b5fe48849", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710004132, "uuid": "8ea0f061-4935-4e79-ab22-3119a85d4c23", "value": "T1C53318C4E903D9FDDC5619712137EB328772F13B1029EA87E7ACAA23AC46B41D44729D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710004132, "uuid": "fd1aeb2a-afac-4d63-a793-0c397a73d978", "value": "1536:O13kynNjv6czSEZeLmI37KNCgoTcpoQzWxS2RAfah5xQ:AUyntv6cuEZ437KAgowpoeiSi1D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710004132, "uuid": "fe5d3401-d67d-40e0-b81a-0406b26de995", "value": 54864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710004132, "uuid": "0195ba9d-b5c3-4120-8c25-0a395ba95ef9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710004132, "uuid": "bba5a1d3-a1df-4447-b85c-899171d1cfa3", "value": "42e94f14dddad4b7ca68fd779b321e33", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd685874-de37-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1710004147, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710004147, "uuid": "3fa3cd17-4cd6-4a14-948c-956140419376", "comment": "Malware payload (Mirai)", "value": "f7aa1f58415a4daad0cb3b83fde23998", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710004147, "uuid": "f3dc6801-f723-490d-b7be-2bc1364ce09f", "comment": "Malware payload (Mirai)", "value": "5721952218eeb566f08af574fb205483a41a704ff6b8a267a7d1b38738a46759", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710004147, "uuid": "9d26cfee-771e-4584-b11f-f24fb142b46e", "comment": "Malware payload (Mirai)", "value": "3528dc418d72fdd48724c0d64aa94579788070d7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710004147, "uuid": "9df7ac36-13a1-43f4-88d5-3959cb3e62a2", "comment": "Malware payload (Mirai)", "value": "f771b61a6912e1f3f4e91642b1a47068dbe6e8fb5798431da6bd5d1e9894e362bc93d250035251fe0cbce08060c39925", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710004147, "uuid": "d1425a18-0e74-4239-b51c-5ed47ee21f8c", "value": "T17DA3D706FF550FFBDCAFCD374AE9070525CCA90A12A93B367574D828B54A24B0AE3D64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710004147, "uuid": "1989968f-7d7e-4f70-bf51-3394d5ce81e6", "value": "1536:0CTVNyBTWIuKXty/LLy43jSZdYq21RFGFgOUAqwKZqlzMHLZTJ3627VukOSio:00VNyBjeP1XGFNYwKHjNukF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710004147, "uuid": "7e157344-3043-4563-9fbc-158e3637ae5d", "value": 101476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710004147, "uuid": "166a40e4-59a0-4222-a91c-407fe3a9be48", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710004147, "uuid": "6c07ca38-6691-474a-b16f-6b61d7c4f3e8", "value": "f7aa1f58415a4daad0cb3b83fde23998", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "961a8a1f-ddfd-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1709979170, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709979170, "uuid": "fced5e81-8d5c-40fb-962d-35c5c0887a78", "comment": "Malware payload (Mirai)", "value": "0da2c64f2603c6b5b6d4169aa0f9a832", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709979170, "uuid": "06cc9720-1531-4dd9-8c09-d22d2938588e", "comment": "Malware payload (Mirai)", "value": "576557acac75f0e35e5cb7ff95171fbb3426bf17273b62cbd4f41d973ac3d93f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709979170, "uuid": "e4fedb7d-b9c9-4967-b4f8-4abe696844ea", "comment": "Malware payload (Mirai)", "value": "1977fe49e1838b23f3178aca32c63e7bbfac2fb0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709979170, "uuid": "ec989713-bb96-4aed-8574-e700cd9a72a0", "comment": "Malware payload (Mirai)", "value": "2b13268c63c8d5c1bc191cf497bb81dff4534f12d2db8ca9200f57e7269f7bc0cf8bf4cef4f35852fb9f73ded0789e65", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709979170, "uuid": "b837c414-9d5e-4e24-bd6a-7bcf3fc25d13", "value": "T11E042A46EB404B13C0D627B5FADF42453323AB5497EB73069628AFF43F8679E4E22905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709979170, "uuid": "e07bf7a7-2dbe-4f67-949c-c63d5fe033e3", "value": "3072:EZHZnVjxrvAqTkYaDsh+OcAc6/HSwBjPm2cJsoyM/RMuWpO:EZ5Vxr9oYaDsh+nA9RBzm2+xyM/RbqO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709979170, "uuid": "8941baa7-4a0d-465c-b5d1-19f85d2a439c", "value": 179803, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709979170, "uuid": "616289c0-7df9-450e-9a5c-d01317b997c6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709979170, "uuid": "56416c9e-1737-402b-99cb-eb1151588f65", "value": "0da2c64f2603c6b5b6d4169aa0f9a832", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ceea22c5-ddf6-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AsyncRAT)", "timestamp": 1709976259, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709976259, "uuid": "1d4ed534-6049-4523-a5a6-2720b0822ef4", "comment": "Malware payload (AsyncRAT)", "value": "e2bace3ad62153a22fadd41c75efc2b5", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-8980", "colour": "#E06B7F", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709976259, "uuid": "eaf6a43d-6ff9-4b5e-86a5-36e296d6c4bf", "comment": "Malware payload (AsyncRAT)", "value": "5912363f5fd71acdd371ce1d02ded655553de3184aa6a6ed1bfdd76f20820448", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-8980", "colour": "#E06B7F", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709976259, "uuid": "cf18be59-83ca-4621-b7f8-52731f3738be", "comment": "Malware payload (AsyncRAT)", "value": "2a3de6ac80d042fe8db39d8fa282a846b3f226c6", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-8980", "colour": "#E06B7F", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709976259, "uuid": "b3247f2a-e26a-4118-ad4d-44698271c3b4", "comment": "Malware payload (AsyncRAT)", "value": "fc814fc31eef1fb5539f9796770f0448a76d43ad79c486bac09b3a22af4bd94d08b7299ca5442f45fba13e1ccbe36ca5", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-8980", "colour": "#E06B7F", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709976259, "uuid": "584b1c42-68b4-4b95-bb92-0c74d2c3d94d", "value": "T1300412481DFE48E873191EA68D1AD517B20EB96C543C585EE82B308B071FA7BBD1B43D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709976259, "uuid": "4665b6fd-0d05-4333-baf8-c35effcd930e", "value": "3072:1QJgft1xjoyAdnHoPw6nqhucIO/TzXkmrZzvVn6DqcihvxPfUjpvzEsZ1E:1QJgftnoy6D8qyO/TzUsJvN6Ocih5XUI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709976259, "uuid": "a1886923-e748-4e33-8cc5-e6a21968a760", "value": 184292, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709976259, "uuid": "b9ef8b1d-fa2b-4007-8e87-2d742b87aafc", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709976259, "uuid": "d0411696-6414-483b-ae91-923e823f0a29", "value": "Fwd; Documento_importante-adjunto demanda-legal_en_proceso N\u00ba 5962301.Tar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53eeb4ad-de0e-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1709986361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709986361, "uuid": "c844f517-5966-4a9c-a2cc-90c07a4218c9", "comment": "Malware payload (RemcosRAT)", "value": "a897e71acd10eb218c4b8c98b2c58f0d", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709986361, "uuid": "bce73fe4-adb6-468a-938c-42d65087b4e4", "comment": "Malware payload (RemcosRAT)", "value": "59c861a26a84d17beb487803322d60ec30260556d20d550ac309bc85851eb378", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709986361, "uuid": "be5c071d-4402-48a2-ba46-3117ea65288b", "comment": "Malware payload (RemcosRAT)", "value": "4515f984d6c45f8de3a2a296a965692587322199", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709986361, "uuid": "b31a6d9e-e9ec-42dd-a737-c6a9d96514d7", "comment": "Malware payload (RemcosRAT)", "value": "d21adc92d34ccc4b1b7fe546fd82539a539847941d827eade3fc1b94eddbd936a59037a6e05e73f3bf660458151666b1", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709986361, "uuid": "45b54aa6-ef3a-4af9-8cc0-0ca06c3ab2f9", "value": "T145B15CD27D942B607653DF027AE1F4F28D1EB757E97BA2BC6040A58813E0C845E057AB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709986361, "uuid": "78fce43e-af56-4c61-8144-35dbaf7ac71d", "value": "96:KVvMev69dHo3vYuG2vwVBAxgQMnXeScYA4c19R8x/yiAc6TByC8KPyCS:KVkeCTuQuG2KWxfkciqqSQnKq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709986361, "uuid": "10b2a4f0-46f6-4555-8926-1c4b4af57e80", "value": 5174, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709986361, "uuid": "8a8ac267-7e54-4f17-887d-6a27a5e1982d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709986361, "uuid": "7c3afa3e-937c-4b0e-847c-0ae3ab773c11", "value": "OOCL OOLU2146153420 0703244654.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0dc46b6-de37-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1710004180, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710004180, "uuid": "ba567ddf-e8a3-4d9a-acf2-eb039eb6b720", "comment": "Malware payload (Mirai)", "value": "b535beb395a11b8619e366b58a1b5736", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710004180, "uuid": "bd8f2c8b-10f1-48a7-ab3f-02bc5dbacac9", "comment": "Malware payload (Mirai)", "value": "5b2ff44578eee8602cdab6593e296640c69c565ae3dc81e0feb6bcb7035ab097", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710004180, "uuid": "e43c2b1a-35bc-471f-a7d9-cb6357c1e45f", "comment": "Malware payload (Mirai)", "value": "685694270de05f2b67af5eec89ba992e6f7b10a7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710004180, "uuid": "afd80583-4852-4c0b-af9e-13cd81e4b257", "comment": "Malware payload (Mirai)", "value": "4b0710149e79f53cb0db71ae2b7d54812dd47712f72619ba41b6bfa867bbc6c887d7a63aa58850e31e7b935c3e97671b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710004180, "uuid": "1250ce84-309a-4dde-8743-0e6aa070385a", "value": "T1D273930AAF650FF7EC6FDC378AE91B45248D641A21993B797D34D818B24B24F49E3870", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710004180, "uuid": "42279c54-932a-4424-93fc-8aa8b70f3370", "value": "1536:vTyl+ONe7VFC5RcIghmeS8psDuPSwtugXB:ryl+ONe7PCLghHTu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710004180, "uuid": "1e09571a-64d2-4053-8866-70dca49730ad", "value": 79852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710004180, "uuid": "149c6fd8-8264-422a-88cb-3a66d512149a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710004180, "uuid": "269a0adc-b9ec-418a-97bc-8eeca513990b", "value": "b535beb395a11b8619e366b58a1b5736", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c526fe92-ddcc-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709958204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709958204, "uuid": "13b7e1db-4665-4ab0-af56-80de3de7a3d6", "comment": "Malware payload", "value": "abb094354dfc0d3301195dbce5818d0d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709958204, "uuid": "0ef495d1-7aa8-4603-9100-2066be5c993a", "comment": "Malware payload", "value": "5dc124b58c8844d7300c1f2fececad54bea84cf930443e3639cbe669367e692c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709958204, "uuid": "b35fa61a-9b64-44db-af6e-fa5c2e148894", "comment": "Malware payload", "value": "e1af2adcadfd3682fc6f7e400bc1ae00c8ac54a1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709958204, "uuid": "2efbc4da-ed75-4eb0-9718-6e99e4bb5d3d", "comment": "Malware payload", "value": "49399b1fad40b99bceaa2d558f213d69f42c64be48786e8427e6215a850424087db98c7dc46f477e50cfb77a3928a2f4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709958204, "uuid": "50d94e6b-3b0f-452b-b8c6-f82f850b54bd", "value": "T1FB636B80B9C648F5F7CC58743D7FF283E632856619A0D3E3D2A8295614E36A28D0D3F6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709958204, "uuid": "40a8a829-3523-4c0f-9816-a06a047a73d2", "value": "952b4a312ae4a10956b144111c92b824", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709958204, "uuid": "afd8aec7-9a8e-4f29-8b68-9a4172aea406", "value": "1536:wKdHN/yjGAMA0+IlzSxDyqPnas96z+XcvjQ/6rnIpFW:wYN/yGAWlz5qPnas96z+XRUnIpFW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709958204, "uuid": "71c1c48a-ff3a-47de-8678-ad544b702309", "value": 68612, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709958204, "uuid": "a9a40b38-14de-433d-b518-9aeee9237021", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709958204, "uuid": "6a5c20e8-dad5-4703-a3f1-b54e039c5e2c", "value": "SecuriteInfo.com.Win32.TrojanX-gen.10998.27573", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56abc08a-de03-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1709981641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709981641, "uuid": "d9597c55-fe29-4182-881a-97d223c58e98", "comment": "Malware payload (Mirai)", "value": "6d4153c301b211c9dd0ba64b7c69019f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709981641, "uuid": "2631c2c1-5dea-46b7-851d-15cea10d98d6", "comment": "Malware payload (Mirai)", "value": "5e52f185e9215551f2dcecabf13933f1404155dd18c1a544a4c386e325408e2c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709981641, "uuid": "87299a33-6bce-4bd8-b8c7-43dd22afd668", "comment": "Malware payload (Mirai)", "value": "2b77f069329eaaa7c5d269fe4205171c2124a723", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709981641, "uuid": "69156c4f-6368-453e-800b-3d9bdcf14163", "comment": "Malware payload (Mirai)", "value": "4a556fc49207c1f4caa9d9fe781224d32c83ae56c43f4d07059be8444cfc0e87cfe5418f60fa4b0882b6a86641cd402c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709981641, "uuid": "dc6762dc-4e0e-4b13-9f7c-adc4b7acf008", "value": "T1A3C31A45F8515B13C6C612BBFB5E428D3B2A17A8D3EE72039D216F21378B95B0E37642", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709981641, "uuid": "7f2e797e-3907-4fbd-930e-f4ad84b55aa3", "value": "1536:Jh7JW6nG5k8wfaaFArFY1LAthi4VvtnTV+HfIo+JSjpChrDObl/Cwyw8FAUk46C3:n7JHg4FAC1Lh4XnR+HfIhMpCho3jQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709981641, "uuid": "51caa311-4fc7-4fdb-bc40-50acffc00ca3", "value": 129792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709981641, "uuid": "cf0249e5-e9bc-42b2-b984-19801248c358", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709981641, "uuid": "427da5bc-b76c-4a2b-958c-42b19adeb64d", "value": "6d4153c301b211c9dd0ba64b7c69019f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8e36a5f-de31-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1710001590, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710001590, "uuid": "8dafeb6b-05f6-47f6-94e5-330f781931cd", "comment": "Malware payload", "value": "344806d69d5895c4a178cb32278ca18f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710001590, "uuid": "21a62b27-9521-49ad-949b-c630c158d787", "comment": "Malware payload", "value": "5e7647b583e649e29af7662c858cac16041a8088e6f5deffa6f1d0148f460476", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710001590, "uuid": "89757cf6-74ec-4985-8016-544a5ce1c869", "comment": "Malware payload", "value": "dac2dee6f31fe824cc639ccde87be0c83687e1a3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710001590, "uuid": "9b02514c-b585-4e8c-a9f2-1cde19153f01", "comment": "Malware payload", "value": "4f78b8fbbf0c4f7c30cc6cfd67af33630726a31ee38719b3223af4986ec630e06640e4768b2732dde7c9c556bb11a1c9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710001590, "uuid": "d9b9b52a-5585-4e61-ad4f-d3d7ca28c901", "value": "T12DF407E6869A4210EB9F517AC982073BBC4474F3536408E7254BD6236B18EFF71F9DA0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710001590, "uuid": "a28a67bf-e245-40a6-9e70-efd105f4c528", "value": "9047ca6913c616fcaa40741dfafdbc5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710001590, "uuid": "8b27af64-8f65-490a-9450-d88f737d1767", "value": "24576:PP+pvZyI9oiJfJulj1CBMeIFjKuQdGhSaApNrWSvUghmjpoVb3/k2JPQIFfUnI8M:X+pxNoxlj1CBMeIFjKuQdGhSaApNrWS0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710001590, "uuid": "1cdc7606-9a19-4d97-b8d1-5bcde3033df6", "value": 789504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710001590, "uuid": "853f400a-32d8-4458-ad82-394d1f3e40e0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710001590, "uuid": "84aa1439-6e5c-4ed3-99b0-f37853594e86", "value": "SecuriteInfo.com.Trojan.Siggen21.1433.15677.4440", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fdb265f-de0e-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1709986381, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709986381, "uuid": "d19248cc-8759-40de-a9c7-883b36740d77", "comment": "Malware payload (AgentTesla)", "value": "c32964295c96a68e20684fa3c92f2e8d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709986381, "uuid": "e1513400-ac09-4779-8541-66e330f352f8", "comment": "Malware payload (AgentTesla)", "value": "5f77d00c25d59a2768f177de6643bc4c655cd621617529691e5339754e1ca118", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709986381, "uuid": "246ce84c-ef99-4ba2-8ea2-cb66502a6713", "comment": "Malware payload (AgentTesla)", "value": "ff935aca2d4fd6249412c54c3c4929ab91488aa2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709986381, "uuid": "aa8c275f-26a4-427c-964b-5072cc43e588", "comment": "Malware payload (AgentTesla)", "value": "b9a10152aa75ef2296f479b96b8dc81257ee1a4198625b6997211807cace8fa83cfa4b94ee8e5b54392aaec5f1c376c5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709986381, "uuid": "c2e4431f-60b5-4478-a919-a92c34d2cfc3", "value": "T1E8657C0676764976F649D735C4E345000BABDD9653E7C70BAB89326A2A333BE9F03207", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709986381, "uuid": "b58c56a5-090c-425f-b6db-7dbb0bd706cc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709986381, "uuid": "d6059110-9561-4e78-9023-eac7d82f0497", "value": "12288:pY/nMjhUaq/0558lByR9F+Nb8YkJmA5MFy6BEqXg/dZLc34ye2psleZ2tEs0aZ6i:pY/MhtdabJ7c6mvSemZbsXeKfuE1C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709986381, "uuid": "1499f8b3-b672-41df-9f90-fbac82ad7b44", "value": 1488384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709986381, "uuid": "27e6f50d-fb6f-4fc8-a771-2e4b6881d8e1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709986381, "uuid": "af89daf4-8a74-40b0-8c94-e1767a69b755", "value": "PO OAU_MARQTRFA00541.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9a04a54-ddf1-11ee-b7ea-42010a9c0006", "comment": "Malware payload (GuLoader)", "timestamp": 1709974076, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709974076, "uuid": "af8db6ef-cdb8-4440-94a6-bd719ffdd3bf", "comment": "Malware payload (GuLoader)", "value": "05ba755853911584893899623bb119c6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709974076, "uuid": "b35c671c-2b7f-4011-9a00-8bd1129f5833", "comment": "Malware payload (GuLoader)", "value": "5fdb56e5df137d59e915131e86516523de39aa04fa52b289c6594903fe722aa6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709974076, "uuid": "36841864-511c-4e1a-af57-5812449c3597", "comment": "Malware payload (GuLoader)", "value": "8793ae9afff5b5d5cb06f5ca5b438f813755018c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709974076, "uuid": "2c368129-1eda-45a9-8730-46d259a738fb", "comment": "Malware payload (GuLoader)", "value": "fba09abf9609bdcdcb5e33bd157de485b6cb6195a317a962be53f24fe6c29158fa1291ee11fc4ba7233a34c9c02d5af5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709974076, "uuid": "ec61b59f-bd58-4e04-aee4-359f82b32ee0", "value": "T1A4D4015EB1526496EF2046378693EE74AF1F6E3C74D2473213B47B780872294CB3E25A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709974076, "uuid": "6fe6b76c-b404-427b-8f3c-6dadae6a68af", "value": "e2a592076b17ef8bfb48b7e03965a3fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709974076, "uuid": "3309ed26-f9f0-4eb5-b3f1-17b50a9492d8", "value": "12288:84mjiqrwQnqdxrBAAWFrxye0AbYHr9ELRVOw5Biv/Mc/V:cTfnqddBA1yeNYL6LRVOcBSMcd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709974076, "uuid": "facf7f48-b45f-4ade-9ef8-74c1121ea8dc", "value": 627136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709974076, "uuid": "70962d57-c528-4c7a-8557-2aa1da8bceaf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709974076, "uuid": "a5855224-31da-4b9f-a07f-eb36d8407355", "value": "Scsi.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edfeeea3-de0e-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709986619, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709986619, "uuid": "71f4e109-ae13-48cc-80b0-f532f362b95f", "comment": "Malware payload", "value": "83c1b5e766d202fca8ec6ed4e642cf4e", "object_relation": "md5", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709986619, "uuid": "40e4e734-3eaf-4e2d-9825-fbb7f5cc3acf", "comment": "Malware payload", "value": "60b8c93b69811055e6d04562e6f11df136008ec78eac49fac38544671fcb4fe8", "object_relation": "sha256", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709986619, "uuid": "796f09c9-ce54-4369-ac89-21fee84967c9", "comment": "Malware payload", "value": "228192a499372c216a0f0c3a27071997f0ce05c3", "object_relation": "sha1", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709986619, "uuid": "7e08d7fb-53cd-4129-8a5d-2483c05088c6", "comment": "Malware payload", "value": "3c75976878b728bf14afdf2f258082803bd08c652fc5cf6a8d325f3a65619fd4291a4d7f0853fe57cb32fc821f096d27", "object_relation": "sha3-384", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709986619, "uuid": "62981759-b579-4cf6-9031-f31d641df6c2", "value": "T12D01A741504ECF76D971737D4262108A8D583686669BC6A178EC8D9823FD43E2D8508F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709986619, "uuid": "8ce8a3ec-e7df-43b1-80bf-08dfb80bf8d0", "value": "6:GGtGTFgtGTF6VkEc4v7QN8SGK8PKThYVkEL/2aH7Dl:FtegteikEhv7QOSGbssJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709986619, "uuid": "a39d7224-c48b-4d93-b86b-ed0f07ed5834", "value": 674, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709986619, "uuid": "a62e7423-71a5-4e9b-88ec-b13f4f722595", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709986619, "uuid": "cd2a0915-b2b2-4833-a745-52604cb799d9", "value": "83c1b5e766d202fca8ec6ed4e642cf4e.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7041af9d-ddf5-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Gafgyt)", "timestamp": 1709975671, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709975671, "uuid": "359bad59-7805-46c5-8385-de923957f249", "comment": "Malware payload (Gafgyt)", "value": "9a570e102a3aa94018e4e809bc1e0d5e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709975671, "uuid": "10a402f1-89f6-4f06-8863-c742b257cc17", "comment": "Malware payload (Gafgyt)", "value": "616bcd4d6932f51681daec89339e4a09749e3b34912f5cbb31e618a805750aff", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709975671, "uuid": "32143be4-05b4-421c-a4d9-9582630a21d8", "comment": "Malware payload (Gafgyt)", "value": "be9a55d2ae3e0b0c55a95f584405a10faa6c2eed", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709975671, "uuid": "69362a89-dc9e-4334-a9e5-7250a81ffb4f", "comment": "Malware payload (Gafgyt)", "value": "d0f35b760567eb506b577f803bafa903e901d63c0f64cc613a9139d60680aa09c37dfca1fd80f2fe3e0deb7cc3adf76c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709975671, "uuid": "ba0d9162-47a4-485f-8c50-4df84b97e97f", "value": "T1DF633B63BE62482BC4D4A67A61F74334F2B2874930BC5B2B3D630D4EAF65B443267794", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709975671, "uuid": "5c860c46-beb4-45e9-af16-de9d230ed3f4", "value": "768:cmjfVLJkeFVEKGJ99/W4NZLuXCFU32brO+NM5VrEd+Ogw1tMkAyAFktGvuSAFgCQ:cmjBJrF+KGU4fKyD7NM5OtHAktGBogCQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709975671, "uuid": "abaf51ed-9a96-49fb-be66-8ad4093495aa", "value": 71660, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709975671, "uuid": "32db8d4c-ff89-47f3-a154-d3432142447b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709975671, "uuid": "d2f41947-d552-49d9-be3d-a61a35e62e89", "value": "9a570e102a3aa94018e4e809bc1e0d5e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6dbfbffc-ddf5-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Gafgyt)", "timestamp": 1709975667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709975667, "uuid": "d690f361-fe1b-4ebf-9ca4-882c73637ab7", "comment": "Malware payload (Gafgyt)", "value": "11d75578f2f6a6c3f06a35b205a58eb2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709975667, "uuid": "a590c793-6216-4a4f-9e9f-67ed1c8ffedc", "comment": "Malware payload (Gafgyt)", "value": "6329f6915857e8be8402be50afdd2ca04dc01f3c21c6eced1bb53f3e6e0f5b69", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709975667, "uuid": "ae9acd19-a538-44f3-958f-1266ec19fbd3", "comment": "Malware payload (Gafgyt)", "value": "8136c7abb17b2a85c9925db5e65c6ed4fc45c3a4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709975667, "uuid": "ca13a228-26cc-4ab3-8b15-ec5bd689d236", "comment": "Malware payload (Gafgyt)", "value": "8d63736b5c898af169d961ac742f0cb30c7404d8529a0b8fa097dfa240868a7b21ba54aadafd52cb830729a061910343", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709975667, "uuid": "8a87163a-6666-499f-8ba6-4c1ae5f1548c", "value": "T1FB634AD3F809DFB6F809D73B449305067230A3A54A825A77B353306BDD762A92973F86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709975667, "uuid": "a5d00df9-04db-4bba-9701-e1fc4f9472e2", "value": "1536:m7pDCdtR2nOXopu158ywBXpZXX6ymwHSwIryNGmcosyFebcw:mMdtRX4pu1EBXjXT7l4mcosyFegw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709975667, "uuid": "dea32481-980d-44b0-9756-e811bbae2e98", "value": 72568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709975667, "uuid": "62085a92-ebae-4619-816a-45bf615f51af", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709975667, "uuid": "be59cf80-704b-493f-9833-a66a71a9facd", "value": "11d75578f2f6a6c3f06a35b205a58eb2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1629544-de38-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1710004610, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710004610, "uuid": "11bf7afd-92c2-41f1-8ba7-65ffde46aeef", "comment": "Malware payload (Mirai)", "value": "192430df1cff98f0eb1a18518e546e73", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710004610, "uuid": "e40b86dd-563c-49f2-9138-a041ca7442d6", "comment": "Malware payload (Mirai)", "value": "650b8b0a50d2539b8cc562f18e239b58d46d6ca4d8326218f8ad2fa03ed2df55", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710004610, "uuid": "5be9834b-5674-4d58-b4d2-73f25f670a6f", "comment": "Malware payload (Mirai)", "value": "20abf4e34300fa844e5a71276721a63d44777a60", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710004610, "uuid": "8e4ca064-06c8-4ae1-b52a-82ad5103aeb7", "comment": "Malware payload (Mirai)", "value": "9f09b04606003dfd677f4626722932bb346afb83df3c955350340cd35355b5b9a759c3e559c85070c361581656437d3e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710004610, "uuid": "22ee6e0d-ec97-414c-a5ef-7cc96d55a344", "value": "T1F563954E6E719FBCFBAC863447B75F209248339666E1C684E15CEA011E7030E745FBA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710004610, "uuid": "9688b7a9-8909-4786-9928-2311ea9524c5", "value": "1536:u8aCKglaDrIjtb3stmjpYpta30byjVA6UQ+e0:9H+0Jb3vyptfbyjVA6RH0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710004610, "uuid": "13963981-d93b-4698-b506-726727f2d505", "value": 68256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710004610, "uuid": "b9ba05e4-7e49-41ed-9e63-7c75cf98afbe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710004610, "uuid": "e24ce431-0437-4873-aca6-fc10bb31a5a0", "value": "192430df1cff98f0eb1a18518e546e73", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94709800-de0e-11ee-b7ea-42010a9c0006", "comment": "Malware payload (STRRAT)", "timestamp": 1709986469, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709986469, "uuid": "581148ca-bcc9-4868-a9b9-abdfe91e245f", "comment": "Malware payload (STRRAT)", "value": "5bda5d7e1cb9f82177cd595a64f42192", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709986469, "uuid": "140cd9dc-b529-4152-bacb-33d496b3e1fb", "comment": "Malware payload (STRRAT)", "value": "652af13e0ac0c11739d0053910d68c64d24de54672ffdf23397637f728ccb12a", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709986469, "uuid": "31a1e9df-082a-411f-8260-48d968137769", "comment": "Malware payload (STRRAT)", "value": "c0eb24d12f82c7b4e719d92bd43857b18f0f087d", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709986469, "uuid": "0721accb-95e3-4950-bd85-16b5902d2b07", "comment": "Malware payload (STRRAT)", "value": "06d4774e3cff65b62c1c72e198612a2368769cddfab24e6a8649baafe105e50de911c815696b1e19956b997aef61aef3", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709986469, "uuid": "505b9311-e44f-4b9b-8735-62281baa9356", "value": "T104051DC510543A1B8B95FB644732E032FC68FD033AA506EABD6C378BFE798146FA9514", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709986469, "uuid": "51308529-257a-4d46-aaa9-ab0741112a6d", "value": "6144:XQSVDydm6qtz1xoWNMCqrmwCHxDDUadXwfWy3O/Ss5z2DiXPC0gdqY/QS/Z0d5Sa:gO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709986469, "uuid": "667ed5ab-d265-4285-a8ac-b32da8afad52", "value": 870521, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709986469, "uuid": "2e5db687-2986-415b-92d1-084ab5182e7b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709986469, "uuid": "40daaccb-6e96-488a-a6c7-d14294123633", "value": "Quote Q110534.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dde32433-ddcc-11ee-b7ea-42010a9c0006", "comment": "Malware payload (XehookStealer)", "timestamp": 1709958246, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709958246, "uuid": "90290548-e898-4e2f-9a18-743e00e53fe7", "comment": "Malware payload (XehookStealer)", "value": "7789d854c72417f4b49dcae6221348b0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "XehookStealer", "colour": "#64848E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709958246, "uuid": "4e30582f-1d0c-42c4-b374-74ac039583bf", "comment": "Malware payload (XehookStealer)", "value": "67a8db376b3438977898afc7c53a01c041191f7e7631c2f14945d55393286185", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "XehookStealer", "colour": "#64848E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709958246, "uuid": "28e570b0-6c94-4b2f-a9be-cc3111794dc8", "comment": "Malware payload (XehookStealer)", "value": "5d4a1f85c12db13735d924d5bee5fd65f88569e2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "XehookStealer", "colour": "#64848E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709958246, "uuid": "2dc79838-85b4-449d-aaf4-2791b047d4f6", "comment": "Malware payload (XehookStealer)", "value": "a940347a29e0af6b2aa5b46b4c1399b677f3a76689d80af3e4a8d7a136e7f77386330dfb7adb62835214dea4faf677f0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "XehookStealer", "colour": "#64848E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709958246, "uuid": "4499d1ba-ca3c-4bed-a4d2-70eefe55bb5b", "value": "T1DEE3A99C725072DFC85BC4769AA82CB4EBA034BBA31BD203945755EDAE4C987DF140F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709958246, "uuid": "8b88be04-3cef-4d36-9cb7-e221c69937c9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709958246, "uuid": "25d4c25c-7304-4f62-8cbe-ed411c3fb460", "value": "3072:sg5hSHWwsgcwVJ/LjOl5L4WqidIvGgPr/5:wHYTwV0r4WqidIvGgP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709958246, "uuid": "c7733ae7-41b0-40dd-98e1-1008fe6ff033", "value": 151552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709958246, "uuid": "fb683468-2510-4e6f-bf40-438959b699e8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709958246, "uuid": "3c7fa3ef-25aa-45f4-bf58-56e4d7320a1e", "value": "7789d854c72417f4b49dcae6221348b0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50a69445-de03-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1709981631, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709981631, "uuid": "c36c2fbe-4861-46c1-b4ac-396c9e32868c", "comment": "Malware payload (Mirai)", "value": "641093d249af07f02acf59716c071a8f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709981631, "uuid": "ffb9e0bd-cb03-4736-99d0-ae784c7d5b49", "comment": "Malware payload (Mirai)", "value": "6b4ac4546da29791f8c82fc0bf3b591d3cd3c27d6220037cdce02fac6f03b815", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709981631, "uuid": "a57ece1e-7e85-4704-8e6b-8eaf4b40d386", "comment": "Malware payload (Mirai)", "value": "10d0abac1fbb3176e7db2e60a19adaae72c231cd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709981631, "uuid": "a2146ae6-7a0a-41c2-8b18-4aa73ad1191b", "comment": "Malware payload (Mirai)", "value": "6522356a254b87b89cc36dc848fa7b559bc177ec860f8a17f1fee644c9a36374873c5c629f42230ee0af1d335e8dcab8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709981631, "uuid": "e1eb510e-d5ab-40d0-9d23-e5b4cbddad9b", "value": "T192042A46EB404B13C0D627B5FADF42453323AB5497EB73069628AFF43F8679E4E22905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709981631, "uuid": "ee8b4665-021f-450f-8198-08a4f5b183e3", "value": "3072:EZHZAVjxrvAqTkYaDsh+OcAc6/HSwBjYm2cJsoyM/RMuWpO:EZ5Axr9oYaDsh+nA9RBkm2+xyM/RbqO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709981631, "uuid": "f8efb424-e22d-43df-af64-fb3441538962", "value": 179803, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709981631, "uuid": "1c5f9272-9f0a-4760-89b0-597559591fa3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709981631, "uuid": "91ad8dca-c598-42de-be0e-08cb415d5560", "value": "641093d249af07f02acf59716c071a8f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "966c47c7-de38-11ee-b7ea-42010a9c0006", "comment": "Malware payload (DCRat)", "timestamp": 1710004511, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710004511, "uuid": "7e8ea33d-0743-4d46-b0ad-28b3efd4c02a", "comment": "Malware payload (DCRat)", "value": "4532cb7893e00b09aa4034faad048de6", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710004511, "uuid": "d1b8cf7d-e0a5-4880-a556-901a74c4a824", "comment": "Malware payload (DCRat)", "value": "6cab5a410c76e1cca044b25d2b7c545418d9efc27ff9d4b71523fbb3bee21728", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710004511, "uuid": "72cb9076-f9fe-433f-b634-c3ebd5270de3", "comment": "Malware payload (DCRat)", "value": "26b3759fadb7afd618c5180db01e391b79c5734c", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710004511, "uuid": "18f70f97-ab2f-4c8d-9ccd-cdb4ed2e867c", "comment": "Malware payload (DCRat)", "value": "890d40b8bec1a60e0027e3db777c6bceec76fcd03dd4ec89d619311328a17304c3d3d835b3f5a25327bffb623312acd8", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710004511, "uuid": "3a8d232e-8cdf-4aec-867b-0463be2ba9eb", "value": "T1C0263302B7D1C1B1E4731E32A75053A22A3C3C551B25CBEF23AD686CD9741D2DA367BA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710004511, "uuid": "ac570c32-8971-41ae-8c1e-72d129a8dadc", "value": "75e9596d74d063246ba6f3ac7c5369a0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710004511, "uuid": "8d41e7d7-0d67-404a-a010-629606863e82", "value": "98304:2ss8OJ0sThJRnua26MlCvfUOUrRAHVPSXRuHL1rS7MMkFtULmM+d:i8OJnbRuayo3BESpShurJFtZd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710004511, "uuid": "bc489300-8c97-432b-b813-b6086a3b39a9", "value": 4463415, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710004511, "uuid": "ddaddef0-488b-4f80-b7a8-708066d7b6c3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710004511, "uuid": "18f9d61c-c2a2-4730-b44c-4e9beaa9e679", "value": "4532CB7893E00B09AA4034FAAD048DE6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d40361f6-ddc4-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709954793, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709954793, "uuid": "18238620-67a2-4417-93a4-8236f28e74af", "comment": "Malware payload", "value": "116390e5195e26b6bd275fbef7f10509", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709954793, "uuid": "84f38768-c6b2-40ad-94fd-f0c3b77c018c", "comment": "Malware payload", "value": "6d036dc7f9e7224d481ded099607254ebaa9280674ee91843f3a822156a17316", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709954793, "uuid": "d6a24093-dbe7-495d-9d6f-23bd60f432c0", "comment": "Malware payload", "value": "7ae75eb20f7d0b04636a4d132de1947b90843570", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709954793, "uuid": "434fea9d-fefe-4aee-8ba4-91825e1048c5", "comment": "Malware payload", "value": "864d5b6a1e7d70fd3adc34f21e21aee1caad3c92a31cced2fd9233efd45a789db298e2104e5caef97eb0ba2c47909eda", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709954793, "uuid": "5c9e56ad-ecaa-4eca-920f-d83157620d02", "value": "T17A4733B70F741A13C2649A764ED0844DEFBC6E43B711CA39F84666DF8F1D96C0292A27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709954793, "uuid": "1a979ae5-9c3b-4e60-b8c0-f93554898355", "value": "08ffc62f03bcefd3f79d179077dd36b6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709954793, "uuid": "52020fbf-ae79-4abc-a3a5-aaa5016e6fd7", "value": "393216:3RzZ5s7oPNMt0qbJyWbmGonqOrPhU4ZhJNwDtkecHvYN5f35yMEQtO/oVupBzwKN:Frs7eMuq4PhU4ZhJ2NcHvwP3ezLMYz4m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709954793, "uuid": "50d85994-c47c-4c15-8b4a-9cc0a6c15f0e", "value": 26843949, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709954793, "uuid": "e85eff61-fd12-4af2-a234-6d91022ad2e7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709954793, "uuid": "686f16a8-e07b-4e52-85c2-41dff6c85435", "value": "SecuriteInfo.com.FileRepMalware.31927.13086", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6839b1bd-ddf5-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1709975658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709975658, "uuid": "3dcfc108-8482-46f0-812b-4184a38d5935", "comment": "Malware payload (Mirai)", "value": "47aa0d2ba4b3ccf5e34932248c662876", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709975658, "uuid": "8c915aaa-cce8-4d39-a882-5017100e1fe5", "comment": "Malware payload (Mirai)", "value": "6d55502cf2b11f2499a8647d154f7e90a83aeae3ab9309132080565d41876c4d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709975658, "uuid": "1aabe551-0b56-40c4-8ed2-b90077a002a9", "comment": "Malware payload (Mirai)", "value": "ceccbfbe1bc4edaf1cb59d0d7d3e5ae6299aa2ea", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709975658, "uuid": "37febe8a-abc0-4807-a83d-2ee578be54b2", "comment": "Malware payload (Mirai)", "value": "27b06e61cf28698cf4adeda0a83cb6a02f47d7204d10c19a83c95789a24d6500dd4f0da9860371543c90bbcf40d9f01a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709975658, "uuid": "56a9576a-74fe-42d0-9608-a38ac935bfcd", "value": "T1FAC38E13EA115E73C0425B3825FB8B34176399A247522F306239DFF85A03ECDBD69B99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709975658, "uuid": "ebe2ed36-c4de-4de9-a499-3a49790532b5", "value": "1536:eNwaxFxhzCECGiPB0F2Uuordq8fGEaMH2Tw8bTH45xL32ve8v64BdYppNRaZtm3j:UWGLoUFB5XbWZTc2m8vrm1rnyeL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709975658, "uuid": "887ab36c-1229-4caa-a86f-dba3a1759a9c", "value": 128781, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709975658, "uuid": "06797655-af11-43d9-a6f0-7fe760a992d3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709975658, "uuid": "12811840-902f-4ade-9d33-61a7fea46a07", "value": "47aa0d2ba4b3ccf5e34932248c662876", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1fed59a-dde5-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709969017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709969017, "uuid": "ec831b14-4216-4b00-8925-0423679e282c", "comment": "Malware payload", "value": "a219fcda21e1c5429351458a5a3463f7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709969017, "uuid": "ab722086-30e0-4856-b786-43d58ed6bfc3", "comment": "Malware payload", "value": "6dd2f9f8015ac0df1f233d8f829946c7077d4e84d78ce536da2bd9786f0b9da4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709969017, "uuid": "622aeb00-feab-4977-a2b1-f23477f54f78", "comment": "Malware payload", "value": "1902edbaf8edf5f18452c4ba0a1b79e52b5d7954", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709969017, "uuid": "432577ba-0919-4552-9c53-02a208106d5e", "comment": "Malware payload", "value": "8ebc8658003a0f284a900c3e5923897fda7c7243b786f479d7796e5f3f96b74f50fef76ab4c0dcaefb6a12848437fb64", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709969017, "uuid": "6d48305b-ee26-473e-b406-4b61a90bd594", "value": "T115830A5BA2065472D53E49706EAF0B5D9B94EE610B8094C3D3F86C3D197B2E3BE3121E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709969017, "uuid": "0cd5dadb-e490-4de6-a0a1-11ab1fa80c3b", "value": "5153d237902c09aa0fc20fd64c74523b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709969017, "uuid": "7e3ffa11-4aae-4c0f-a520-34c1af88c7d8", "value": "768:DUq9oyf3APc7UTL7qS/koORqUtiNfgCEl1VDISbeIfwRFTkUHewzRU7Mit7JLxy2:dMMVdeIfw7TkUHewzkck/WYA5LNsgr4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709969017, "uuid": "7f1449cc-59f1-4a56-b896-b3ca236136dc", "value": 81920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709969017, "uuid": "0d22f422-8b52-4a8c-bc16-2f64fc0baa5d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709969017, "uuid": "7d11cf85-5b05-4c06-9764-bd01a98edc61", "value": "SecuriteInfo.com.BScope.Adware.Presenoker.27125.27482", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e890aa43-ddb4-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709947956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709947956, "uuid": "17aa224f-77b6-4fb8-874a-3fb860663cb8", "comment": "Malware payload", "value": "05b697dbc88bedfc5bef359d1672c7c7", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709947956, "uuid": "39d3f99e-c203-4d1a-bc1c-3ab8f5412c09", "comment": "Malware payload", "value": "6e0db753819284f825d92f9fb6f7af7562ae2e3726b3115f3c31fb8aa8bd8f3e", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709947956, "uuid": "bb1ba7fa-cbd9-4745-a43c-e1e4a298be98", "comment": "Malware payload", "value": "dc9b700164dd3166759d76a52a09afd6100971a3", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709947956, "uuid": "73a8d60d-ca07-47aa-ae22-1eaf194b2574", "comment": "Malware payload", "value": "03b0a2d8f1a639776512ca03ecc58aa4e8f589e0c5e6cd605e9e59baa424ae3c270db51b4563472566fb73b76305ad6b", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709947956, "uuid": "a88ce88d-3753-431b-8437-309bb4358df7", "value": "T13F6633DFDBD8E007491C376CA59FB0ABC1882757B2CDAE064FC9AB2553FAE26508D411", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709947956, "uuid": "b12aadd2-1d02-4d90-b79c-ce997d6cf4c2", "value": "98304:cxk0QOuTNiuEGGJMPiKP14fqulRpfHx3E0dMU790vfroTgC9+Kv2nP1WR38XkCQS:cxsouE9+1eH1Eooc+fUbCQLpPFpFKu8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709947956, "uuid": "ea6b4d99-602b-4641-9493-05b6c7f5e6b7", "value": 7007958, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709947956, "uuid": "d94d8d86-8c82-42c6-9d70-668a34a30b02", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709947956, "uuid": "c60ce8fe-8f62-4b20-87c4-57974360bf82", "value": "dalle3_setup.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9b6fb9b-de37-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1710004248, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710004248, "uuid": "873ad513-11fc-48e1-838e-b0310680cd9c", "comment": "Malware payload (Mirai)", "value": "bbedb7e2258d51b146360d8df3ec9fa9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710004248, "uuid": "e677520f-2027-4a09-a2f5-8b6e4ecf5d5e", "comment": "Malware payload (Mirai)", "value": "6eb7521604ea295c1e4763f463c9ab2385ae4d93f20cae660876425f80bbd9b5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710004248, "uuid": "e5af28b1-a419-4ca8-82c3-c4e5fe62aeae", "comment": "Malware payload (Mirai)", "value": "5d20352640fb5956c68bf712b600553a227bebd8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710004248, "uuid": "7adb9bfe-d3de-42ec-bb07-7948227846d5", "comment": "Malware payload (Mirai)", "value": "7fb2a8fca588fb3fda6325ae04ce9b2e80132f720d5636c8f289b4f790b684baabcaff890b33690c5ef8c6b41b876e26", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710004248, "uuid": "946634ec-56fe-4e73-b7fc-d0bfb7690b94", "value": "T1DC53F946FC818A02C5C5137AF92E118E33136378E3DF72529E106F64778A96F0E7B956", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710004248, "uuid": "c2f66e60-052e-44ac-a8b3-5e2f058122ae", "value": "1536:c17nBC0Da+AfQAdVmEkXOqf2czKGLYV4AKF1LDkOL1I/iJocFZWua:E1C61AzmBeq+czK9VLKFfocFZWu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710004248, "uuid": "d0913d30-ac0e-4836-948a-2925e5613a74", "value": 63164, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710004248, "uuid": "c7bfc813-4bca-4db3-ad88-5e4e15702e0b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710004248, "uuid": "b3ae6185-092c-4346-a2d8-cb19a80611ff", "value": "bbedb7e2258d51b146360d8df3ec9fa9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3960887-dde2-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709967597, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709967597, "uuid": "f01cd2da-5f06-4c46-9517-25f3c0c4b99f", "comment": "Malware payload", "value": "2087eb2d3fb639933ebe0a0614fd5218", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709967597, "uuid": "f213a23c-5460-4d74-be62-ab00e1faf9d3", "comment": "Malware payload", "value": "725f50650cb9490027b633a1ff0ae166cb6fc42037dbe72d9a09dd65be323a1f", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709967597, "uuid": "a972d454-c019-4f29-9e63-8bf8ba7feff1", "comment": "Malware payload", "value": "c1a1b75c8e76e000b7045092bd11100904a72840", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709967597, "uuid": "d340617e-9dc2-4fc8-97f1-992766a1f0e9", "comment": "Malware payload", "value": "9a2663a4ff6fac94c67bfe0213a645217cff224760355a465bd75d470940ab70335dd2ad5facd45d80c38c07b4bdc252", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709967597, "uuid": "c5c195e1-21ba-4e84-ab70-ce61b5d4979b", "value": "T1B3C56D126BE5843AE3BF0332597D632852F9B6B10A30866BE394571D6EB18C3F435B17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709967597, "uuid": "974ab332-9941-4fbf-8bb0-93db06b11c9a", "value": "fa7c8532750a5f21a82ad7a1fdb4059e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709967597, "uuid": "d85ff9ce-15b2-4bdc-a8e0-3467b53e5909", "value": "49152:LvSyYrklCgEFFKYy3Hlll43MkyoYh0iXGu2B1BIthEjlI0UZhQZZmRvCH:GEkglDlH1VZ0uGu2lIQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709967597, "uuid": "73d20c11-b6d1-4ae5-bce1-697b6d4ccdc4", "value": 2637632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709967597, "uuid": "f273cf09-7288-4bb7-9d73-4ffadbc76025", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709967597, "uuid": "9d093260-6dd8-4ff1-b49f-b0f9bd17679f", "value": "ptMgr.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e04b3a76-ddfb-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1709978436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709978436, "uuid": "036b65c1-7680-40e0-af44-e061cf5f2180", "comment": "Malware payload (Mirai)", "value": "2338a4b3b7a125b00fca4d6012aa734b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709978436, "uuid": "190410a0-57d0-495b-9928-4c2669a00361", "comment": "Malware payload (Mirai)", "value": "727fc5d10410d8c6c5b15402eadf92cd4aa058910de21c807f18eab01f0bd3e2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709978436, "uuid": "dc9d62f7-56a4-4aae-b577-44678b099c8d", "comment": "Malware payload (Mirai)", "value": "38103bc650b003d26c19b2e0a46b954f636d2a03", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709978436, "uuid": "45ebc9ca-6b89-4698-b86b-500dbd169c7b", "comment": "Malware payload (Mirai)", "value": "7311f58ed29377c30ea993e88e21e63d5e2ccb9e763478bc4cd3b5276954e6079bd8317cc7852c975b39799a946806b1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709978436, "uuid": "730357d3-e152-46c9-bd88-da3be7a2c509", "value": "T13A839226BF211FF7ECAACC3389A8574528DC641E22997B757930C428F24B25F55E38B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709978436, "uuid": "907e93e8-8ef8-4931-8604-bb598e9d10ad", "value": "1536:8OyXUyQgt0QfA2glfykiszlQE78Sw8XA05Z54CldZ5F3sSid42+:8UykisRL3wQldW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709978436, "uuid": "b5ad8e1f-bcf8-40dd-88f5-df1834c1c030", "value": 84084, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709978436, "uuid": "22940399-1043-416b-b0e6-6f9fea061c74", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709978436, "uuid": "632f1c3f-7847-47a2-abe1-787fc2890c17", "value": "2338a4b3b7a125b00fca4d6012aa734b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7ea4742-ddfb-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Stealc)", "timestamp": 1709978449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709978449, "uuid": "79f906ff-c222-4efd-a634-9449ce8c6dc7", "comment": "Malware payload (Stealc)", "value": "01adedf068d872dfda9ec7c3443d9246", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709978449, "uuid": "cb5646c0-aa4c-4511-8b1a-5d19b3f608fe", "comment": "Malware payload (Stealc)", "value": "72f3a3e58f328f6f13f00cb15861b53effe7b57c2d2062b272a7ef57d37c0ff9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709978449, "uuid": "00ff489a-ec8d-48e2-b0e7-8adbfa674b41", "comment": "Malware payload (Stealc)", "value": "bebf339db4ab4f7f94989210ca6a64e9a585c811", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709978449, "uuid": "6d66ae0a-bb58-44af-b16f-0246df9cddf2", "comment": "Malware payload (Stealc)", "value": "303000adc09806ecd0b1220ce0879a066d48727e2ea8950b1455c020fedace05a1cc05e6c184100b827603d2be075385", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709978449, "uuid": "c067868f-1533-468f-b609-492ce80e12e7", "value": "T1DBF3D0527AF28536F2F74E3409B482B4593BBC923B75819F76A4332A5F712C14EB4322", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709978449, "uuid": "494bf189-2915-4471-9067-d930439db56d", "value": "a6a6c071537f8fae36fa27a84ab86d64", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709978449, "uuid": "bdb0e942-d4f5-424c-8500-cb2184208e2b", "value": "3072:z9j28lIQdaoYzzj3XjSlrwIq1dYrtXhmWNV2:z9j27QOf3zSlZcmRmB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709978449, "uuid": "b3fa9e3a-bc68-42d5-b07d-57c28a5ca29b", "value": 166400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709978449, "uuid": "2fa35687-ed5d-417c-b13a-b9b1795d924c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709978449, "uuid": "ec274c2e-08a4-4259-8566-cae07d590b2b", "value": "01adedf068d872dfda9ec7c3443d9246", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1adc401-de07-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709983539, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709983539, "uuid": "54c5f5b4-3300-4607-9790-3820e4ea2308", "comment": "Malware payload", "value": "476d7d250ace6eab6910afb17fd281eb", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709983539, "uuid": "03403373-2440-4a99-bbdf-0134f211d8cb", "comment": "Malware payload", "value": "757258fe96b05758565ee2bfc31593cf5153e3a20c51c75dbc6fe6f3080f2992", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709983539, "uuid": "9fb2b60f-2744-40d3-869d-abcbc8c62297", "comment": "Malware payload", "value": "372ab947e46721435ad709bc7ed08bb8a84cf572", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709983539, "uuid": "68205954-4c99-4aa3-b8d8-2ac06ce660d4", "comment": "Malware payload", "value": "3240a413bb7334edde6053e4863481e9a2230e0e3954f54b7baa3684197725122ddcfb9cb2df9f51c8db5239cf7da153", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709983539, "uuid": "83917877-d1c8-45d1-8074-9e32d1c5d5ed", "value": "T1D2C3D12DC34B02598F620376AB1B1E5542BDBB7EF39552B1302C537933EAC39A1252BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709983539, "uuid": "e86e045c-d879-4726-b81d-989c508cc2df", "value": "768:NwAbZSibMX9gRWjtwAbZSibMX9gRWjtwAbZSibMX9gRWj8uUU/zeVUVuQqtWS7Vs:NwAlRkwAlRkwAlRxu7/zQUVuQqtW+O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709983539, "uuid": "d58ab45d-3a40-4e80-8523-5f32b2fdba5a", "value": 124350, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709983539, "uuid": "c751a697-f186-4fb3-bda7-4563e00f708d", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709983539, "uuid": "240fdc2d-a1c7-4ff4-86c8-f06b1cd40204", "value": "Order.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f49ac3ad-dde5-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709969021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709969021, "uuid": "09559ab3-7e64-4e8e-96ae-d5b81e1e2a87", "comment": "Malware payload", "value": "a548b0c64ae88754c358a6c2b5dacb11", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709969021, "uuid": "690fd13b-47e7-4bd5-ba8b-ead21848a3ef", "comment": "Malware payload", "value": "7584c07aab29f2b5c3a30f04ef988d7cba954529322d580d93099ef2e4f2b53b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709969021, "uuid": "02ca6ee1-970c-429b-8c78-b7bdc2010be5", "comment": "Malware payload", "value": "1fab8148ed0eceb77d8b94db083328dd15b9a924", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709969021, "uuid": "8d8dbac2-7569-4f50-ba03-86dc49d4f7bc", "comment": "Malware payload", "value": "38f27b2b06eac8ba7c2705c8c26dc97f708f72f4735144bcdd491cc7151084b3c777bdc2fbb1ebc2fb389d1b5ae3e9ce", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709969021, "uuid": "5b6ef45d-776a-488c-9709-b84e87189649", "value": "T1A0140911E180DC3AE87F09B154EED6A96958BE38C71160B7A3C07D7D297A1E13EE121F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709969021, "uuid": "ad5803c2-340a-49c3-ad0f-76cbddb257a2", "value": "540442761d6838260d0cff5cd8664cda", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709969021, "uuid": "99fb8c89-3ec5-499e-b1d0-1d7f34bf8536", "value": "3072:RcoLCbZVCS6Yq8HIHsymsroAyenZX7s/3EHo9rvPe7MJDDbYYYBsx04H8Ds:pCb7l6Yq8oHZmsEAye57vHWrveUnKs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709969021, "uuid": "04c8fd61-52fb-4849-956e-5bcd3e77ed16", "value": 207944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709969021, "uuid": "2c3d8812-4be2-4573-a4ed-dab1b353d1ba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709969021, "uuid": "090fbac8-7fdf-4022-9b9c-1d6f5b58c00a", "value": "SecuriteInfo.com.BScope.Adware.Presenoker.23903.16620", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb0b0916-de0e-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1709986534, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709986534, "uuid": "4453ef7a-5aaf-4f7b-8b15-e2c557f6cd42", "comment": "Malware payload (AgentTesla)", "value": "91417224746d4ac2d06b990b0dd89f9d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709986534, "uuid": "be509f45-7ac9-4926-9911-0c12efad2a8c", "comment": "Malware payload (AgentTesla)", "value": "7869789a933db6e35c8b5da0f29e17e8f6799c352690ac047f108aa2d0a8e9fb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709986534, "uuid": "f37d314b-1095-420b-abe2-8585dc98b6e8", "comment": "Malware payload (AgentTesla)", "value": "db3df5eae95dee85718f5d05cb0a454ee1dff776", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709986534, "uuid": "2d9b09ce-63e6-465f-993c-90431256f191", "comment": "Malware payload (AgentTesla)", "value": "93643bcb489dff023dc2852759ec96a46652af7bee78c8c15e5e4418c6ab003833a90ef43bea7c9d93818103bd2fa679", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709986534, "uuid": "0cde7cfb-b2fc-40bb-8efa-e30ba04ad88e", "value": "T17035AD02B3D1C032FFAB92739B6AF60556BD79254123852F13981DB9BD701B2263E763", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709986534, "uuid": "004b6980-7235-428a-b5bf-0d9988378801", "value": "afcdf79be1557326c854b6e20cb900a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709986534, "uuid": "fe3988d3-eae7-4da0-b2e6-1d7d2adf2046", "value": "24576:mAHnh+eWsN3skA4RV1Hom2KXMmHausv4x0No+E8Q5:Bh+ZkldoPK8YausQCNE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709986534, "uuid": "6d5671aa-6e3f-45ce-9cfd-f00303e4a453", "value": 1105920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709986534, "uuid": "8e7a1cf0-20bc-4fa3-bbd1-3d261a1b244f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709986534, "uuid": "b7457723-5573-43e4-90c8-0926b361a80e", "value": "Ziraat Bankasi Swift Mesaji.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee724cf0-dde0-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Stealc)", "timestamp": 1709966863, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709966863, "uuid": "61cb1910-f886-4a62-96dd-90ef44156c99", "comment": "Malware payload (Stealc)", "value": "fc8086894915b40db08d1aefa379293d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709966863, "uuid": "b0cb5f85-a58b-4192-9f6a-7a69ef9e06dc", "comment": "Malware payload (Stealc)", "value": "7958ea6d6076346478dc5bf323b51a4e8e47a104357070b4c8e6ca4e02fecd96", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709966863, "uuid": "da2a4872-c9c5-454f-beae-5ac43abb4194", "comment": "Malware payload (Stealc)", "value": "1e40855b26d8d9653b09e5d9acb3b8046b30d683", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709966863, "uuid": "a7073dd4-fa33-4a76-9243-4a1c9c5ddcfa", "comment": "Malware payload (Stealc)", "value": "5de7458b803d2eeeb4ed153a9ee3d4b2c804c92b3c9baee34fa51bb66d916e3b1a75b698688eb0a84808f0ba7a812979", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709966863, "uuid": "da08a432-10f9-456a-bdf5-e513f7ddbe81", "value": "T11464019272E1D435E4E3557098B292E0AA7EFC523778408FA768277E8F623D65F31312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709966863, "uuid": "d2050911-f1a7-4cc1-b999-a3ac49d144c5", "value": "2d3b460caa86ad92cecbea0585c3a401", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709966863, "uuid": "ae02c6b4-ff72-46b9-8a67-9d89988ccef6", "value": "6144:XxI6ZHCYJReiPh7O0ZTz4iPpDOLfQzXZBc68YKmrK1wYr/r6:WIHCYF7/v4vf0rxvW1e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709966863, "uuid": "67852597-3d14-418f-9f8f-71dbbe49a62b", "value": 316928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709966863, "uuid": "b5fff180-58ad-4b1e-8e73-baa57052df49", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709966863, "uuid": "7176d9b2-9996-43ca-b1fa-45b8838de1e7", "value": "fc8086894915b40db08d1aefa379293d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8aff7adc-de6d-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1710027255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710027255, "uuid": "92ca5d6d-2257-4f5c-adf9-5651f2789542", "comment": "Malware payload", "value": "3d96e5cbb1fc1bfa56b1f6a31635389e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710027255, "uuid": "3ef3a9dd-43d4-43c2-8784-0583e7919f39", "comment": "Malware payload", "value": "7a3e0dc2f82fb9a3ebd15b59dd972c1a8c6f261729b9cf1695e694d352cb095d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710027255, "uuid": "d41803fe-dc95-421b-a8a2-9af9aba29ddb", "comment": "Malware payload", "value": "72a6491cf83c954f7c367079dfd8926afef815cf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710027255, "uuid": "2c72d461-3e5e-4cf0-9eca-668d2dc59a07", "comment": "Malware payload", "value": "288314c5dcb2d38a33f1469c7b7109607f69c8766a9e78f80804b9b677daf4ca4d6ffe0b9ad237f86760149e7abab138", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710027255, "uuid": "98d8123b-e27f-44a9-b642-1d6287854379", "value": "T147C4D5417BA84D80E57B8BF94460C07087363D4A5829C70A29E9BCEFFAB37D15D4AB53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710027255, "uuid": "d3fe4411-021d-4040-949e-63a2179d9926", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710027255, "uuid": "884156a5-6af9-4cfe-a266-afa90dfd7d14", "value": "6144:WmEJRTWsKxA9bkCAitROyCQeobqUxOyCQeob:UwppivObaOb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710027255, "uuid": "6cb4e00c-c9e5-4861-9f2d-e38301783bb0", "value": 549888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710027255, "uuid": "ce8f5ff9-a95d-4191-b24a-200001d7e9d1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710027255, "uuid": "bca2fbed-7579-4312-ad05-34899dc4a946", "value": "SecuriteInfo.com.Win32.PWSX-gen.22598.6399", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94edcb4f-ddcd-11ee-b7ea-42010a9c0006", "comment": "Malware payload (CoinMiner)", "timestamp": 1709958553, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709958553, "uuid": "7b3a1493-ee09-4422-a42c-4a316f82b5e0", "comment": "Malware payload (CoinMiner)", "value": "2943372a2fb0a4784b5f4e3e4afbec3a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709958553, "uuid": "d5459419-efe3-424d-a0b4-a8b3d3a0e730", "comment": "Malware payload (CoinMiner)", "value": "7a49266816bb7b05db0c1e9a5a7100a7f70968b335cb19a55fee619f20d27035", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709958553, "uuid": "e9fbfa19-072e-473a-9b54-528fa7759f5c", "comment": "Malware payload (CoinMiner)", "value": "744baa25812e42ba86d5ab10d5486feb55a3d541", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709958553, "uuid": "97061759-5e5b-42c7-9e1c-b4806cb6d62d", "comment": "Malware payload (CoinMiner)", "value": "f61b84a81c179788b8f745a28779d78b0afa4493a8db3d9e0e9e370066b51e5a3cf5dc17b041708d0212a139f0c7afc2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709958553, "uuid": "e5f55530-c573-4b2c-b4aa-fab988511aee", "value": "T197248D1178D1C432D472253149F8DBB95A3EB9310BA699EFA7D40F7E8F302C1D631A6A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709958553, "uuid": "e39c9333-a59e-4500-a14c-f5b7c20d5391", "value": "f198d8abcbaf81c3dd60f47e8f08fb69", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709958553, "uuid": "a1544942-b6b6-4d8f-b830-87cc9d309f76", "value": "6144:uJ680lKDCBp2i1CrZWMe3lIo5AOJkP3YCL:uSoDCBp2i1X7rXWYCL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709958553, "uuid": "5fbf5fd8-08a6-449e-9eb6-20853ee8cc39", "value": 215552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709958553, "uuid": "2b55f650-4e39-402c-82df-f54353e80277", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709958553, "uuid": "6b9ad6a4-9ca0-424b-ba44-a310df2cc65d", "value": "2943372a2fb0a4784b5f4e3e4afbec3a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2c01bc8-de0e-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1709986520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709986520, "uuid": "ae65ab4d-8e64-4b94-b54e-09232b20fdce", "comment": "Malware payload (RemcosRAT)", "value": "9f76e4b699ec8f679b9c4b6b8ecd2934", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709986520, "uuid": "49f5b021-c75f-4992-87d8-433b460881e8", "comment": "Malware payload (RemcosRAT)", "value": "7c3ee63168ad6a482c01546202c85ab10c7b2196672bd42876b760f15ea96e05", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709986520, "uuid": "cdf18492-febd-44a6-8515-6753ed6d856f", "comment": "Malware payload (RemcosRAT)", "value": "21ddc6631488483d7fa891c02fabdda9accefbae", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709986520, "uuid": "2192f626-5854-4580-998b-2fe34c18510d", "comment": "Malware payload (RemcosRAT)", "value": "d59d1e45b8a456f0b2a0614613402e79eae145c0f3f23e3b39bb86c0f7cdfdbd6c2e56f1fae09ef73f8a83c8bf922bd4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709986520, "uuid": "686bba3f-01d1-4192-97ee-f69da3e06f41", "value": "T1DB259E23A5ACBC33DD9609346EBAF6F45818BBF52E585D967FE0381C46393813839187", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709986520, "uuid": "b97f6de0-c856-4063-ab67-ebe62c890873", "value": "ede4a721a0b9bbea83535c909d0f6b2a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709986520, "uuid": "0ef40dcd-4393-4dc8-9200-33157c248bc1", "value": "12288:AfSx+FaMjOnJBReneIPcVCXGmBOVVrd4yABuAMQsWIUN2FELSvVeCs9axIeBnhnK:CkPMjOn/ieI37BOXZ5oiG2F02sInBhn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709986520, "uuid": "440cc273-5dd1-48a9-8460-1b68436932c3", "value": 981504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709986520, "uuid": "711e88fb-82e0-4b91-b435-142a1bde0a46", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709986520, "uuid": "8869f498-fb11-4e52-8397-0783c0c0ee6d", "value": "Swift Advise Copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f25dfac9-de3d-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1710006813, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710006813, "uuid": "54664b10-749d-441f-81b1-2a51a87f2ab1", "comment": "Malware payload (Mirai)", "value": "9ecea0f5cc9580d389442bafe6ce7beb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710006813, "uuid": "7e25ba0e-94d5-4183-93be-caf9078e787d", "comment": "Malware payload (Mirai)", "value": "7cf007d41106c70052942c9adcffc9b37335562868fd2d8ef5bd3635107091d5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710006813, "uuid": "972b73eb-b3aa-421d-8e46-dff2de32dc1d", "comment": "Malware payload (Mirai)", "value": "24b4a45d10c8914cd44c62886936acf4309a418a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710006813, "uuid": "06425310-8c14-467b-b204-e339bf749448", "comment": "Malware payload (Mirai)", "value": "67c945b37e2497a0bcdebcae21cbb021273df6eab4f45c5ed79910fd413fca70c40e8affd9fddb6afdc4cd704917c3cf", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710006813, "uuid": "4058fa3c-a8ef-4039-a643-28b7d649fc52", "value": "T11EB35A73C8256F58C15AE174B0B18F792B63998182471FBE19B6C2B64483CDEF905BF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710006813, "uuid": "b80a7e5b-3e79-457d-9b00-cc79eb585154", "value": "1536:paN/Y4/LqAgewm1vcSFylwv206jz8/e5L076CaC7WCbo4lNXQUyIbCWlcHOV06fn:px4YeFe+GxXmLb0LtWW3dRd8j0Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710006813, "uuid": "20f49f06-519a-4570-8d40-87c784330d9d", "value": 117568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710006813, "uuid": "000be0d1-fe8e-4010-a572-bb94b59f9a2e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710006813, "uuid": "0ef81c58-501f-4154-93a4-6b60c68356d3", "value": "9ecea0f5cc9580d389442bafe6ce7beb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4c6d063-ddc4-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709954794, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709954794, "uuid": "c5ec3a3c-a7d1-4c76-9124-202dd0b0c10e", "comment": "Malware payload", "value": "b59ca50205dc7606185ec3a77949f914", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709954794, "uuid": "7b1e2981-d168-4318-8ecb-6e0a1fa00c0c", "comment": "Malware payload", "value": "7da483359990ad573fb54b1e0f1bbcca3098edab623e158d7dd233dc88c66366", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709954794, "uuid": "ae3b2a31-3412-4af7-b1ca-bb322b197948", "comment": "Malware payload", "value": "c833fb417fae390cf3af42f07d5e6ea0900f11fd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709954794, "uuid": "5c0e444e-6d5e-439b-9b01-e4bff9c44912", "comment": "Malware payload", "value": "e75022d92806e4de46c599d3a0f1e3b5680cd82585403c6f7bbd859780068e7f026c34a99e72fcadff32f45dcac48fdd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709954794, "uuid": "dc68df4a-8248-4c7f-b5f7-78089136d97b", "value": "T186B5332340B49D66D946B9309054E9A21C041A5A2FD2B6D18D97E8CFDFFD9C3C7E4B23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709954794, "uuid": "64e307ae-c63c-4fd4-9a20-bb94c5b42891", "value": "d879a65e465b1c412670e44fbe2d8e6f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709954794, "uuid": "ef1922b3-9122-457f-96cc-c05500daa23c", "value": "49152:E5C0L+XG0osKOI0ud1DSTNzOtbwv5x6ATJqx5jwYg+4QztIA1:EZL+q0I0ujSTtOt0xxbajwF+ntIA1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709954794, "uuid": "f3bcf876-c358-4969-8f0b-628855720025", "value": 2349832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709954794, "uuid": "28c2ba9f-4bc0-4530-8da1-229e073cb2a2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709954794, "uuid": "f80df30c-0d74-4558-917b-ef0b80220585", "value": "SecuriteInfo.com.Trojan.Siggen22.10132.18734.19258", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ef41a1d-ddcd-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709958543, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709958543, "uuid": "53b9baa3-a854-4503-86f8-acc4bab13f41", "comment": "Malware payload", "value": "ac22398267dcb36ef75955c92cec2e02", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709958543, "uuid": "6e400204-387a-4105-a8af-a379486bc2a1", "comment": "Malware payload", "value": "7dbfdc26680dd6db6c57c79754ad2a70d34074195aa787f0236223fe69b2ac0d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709958543, "uuid": "59e7f1de-0f4e-42b2-9a90-12fad85d04ef", "comment": "Malware payload", "value": "a8c2c3d9423609c49aaee150451e32605e0e88aa", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709958543, "uuid": "0cc69004-8b54-4ed1-bc4c-e1ddaaa0da86", "comment": "Malware payload", "value": "68e2be63e31cd99cfc6d3095571941a639b4125f128661c42d65ff0729c70b21e0f93832e421728286c4a8fb8912d749", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709958543, "uuid": "c173e083-d140-4868-a3f0-e824822917cb", "value": "T18A159E0273D1C062FFAB92334B5AF6515BBC69260123E61F13981DB9BE701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709958543, "uuid": "f1297021-d88d-4062-93e2-be492a0da1d9", "value": "948cc502fe9226992dce9417f952fce3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709958543, "uuid": "c42d3270-5e9d-4b06-879c-c8c34fe1c4d4", "value": "12288:DqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDgapT5:DqDEvCTbMWu7rQYlBQcBiT6rprG8at5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709958543, "uuid": "7a6a4a4b-7991-48ab-bf0f-32acb7069d79", "value": 918528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709958543, "uuid": "5f580e2a-0997-4441-ba9a-e1a7f57ca83c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709958543, "uuid": "2c9aa752-f01d-443c-b42a-f3aefbd9d67f", "value": "ac22398267dcb36ef75955c92cec2e02", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6c8e061-ddf6-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1709976273, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709976273, "uuid": "b1fc915c-4a14-43ff-ae39-bce5e0fdb704", "comment": "Malware payload (Mirai)", "value": "fc6644f15aa5b2c1375210c87724d03d", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709976273, "uuid": "0de04d80-96c6-4d4b-a224-ec743b876e08", "comment": "Malware payload (Mirai)", "value": "7eb2065c626799816f55a06dbc1ced2c1427f5c02762171242e07918cabb5a1a", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709976273, "uuid": "86b93a1b-0cc1-4ac7-a0a6-a2b9f1870d79", "comment": "Malware payload (Mirai)", "value": "873dab96fdb6e6af224fb7a101cf9c936d36209e", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709976273, "uuid": "dd5129cd-17da-4031-890b-93a2a3367bb7", "comment": "Malware payload (Mirai)", "value": "6dceb9fefb1b2ec1995fbe4334a54331218c6c3df23e7fe87935d2c28c1f0d54b7de7cc700d400c1c42fcece4d0ef2e4", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709976273, "uuid": "11b6538f-71d3-4d76-b01f-239db3d94d01", "value": "T141E30A56F8819B12D5C111BAFE1D128E37131B78E2DE7302AD246F747B8A87B0E3B905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709976273, "uuid": "e412732e-2dda-4b7e-8149-7891f7020a15", "value": "3072:0CKeUmbgWz4XFQ9sHwIaOOxGjBPCm3CR5RjE:0CDpn4XG6Hha9q/3CR5RI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709976273, "uuid": "e2ea7d7a-eb0a-4395-b153-4afed8a71cdb", "value": 143260, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709976273, "uuid": "d110fa1b-30d8-4b85-bc97-50916f6d926f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709976273, "uuid": "43adcfc9-514b-44ad-ae56-27d8ec136636", "value": "vlxx.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de21da61-de37-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1710004202, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710004202, "uuid": "aad95308-4db6-4ea1-bb5b-2bb0b1f05c4e", "comment": "Malware payload (Mirai)", "value": "d3124ebd0351481f2f96358a748778e2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710004202, "uuid": "e32df52d-7802-4640-823e-c6ad4ea50f7c", "comment": "Malware payload (Mirai)", "value": "7fbf47c398f07b5da49c4682c470b99d4769ea3adc830cbb95f6a6f8b7412462", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710004202, "uuid": "082ebc6a-a3c9-4d86-aea8-5d70697eb438", "comment": "Malware payload (Mirai)", "value": "340166217304a80983417c4da8fc9fc562810a37", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710004202, "uuid": "58ffe631-2f92-49de-a45c-e23860b87ae2", "comment": "Malware payload (Mirai)", "value": "fc3d90b2da84075ecb727049f1cdf87d247eae1405a2818b15305878ffce584497e6f8cf20ede8bd025c74891efbb332", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710004202, "uuid": "c030611f-9eed-4ecb-8c78-205e0f4e0199", "value": "T119234BC5A447D9FCEC190A752177FF319AF6E93F1098D983C398AD72E942602E5072AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710004202, "uuid": "857296ec-c955-451c-9e00-b713ba7367f6", "value": "768:Ii+liNWE5FttdEioOs5BcbV7UzVPVKWfd/0I6SDZkhoo:IiK25FttdEioOszkV7UZAWV/0I6OZk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710004202, "uuid": "ab728cc8-4815-4186-80c4-bbc6568f9fd9", "value": 49756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710004202, "uuid": "3a1d0ac2-b0bf-4af7-b2e5-b1416b7161be", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710004202, "uuid": "acbbb0f6-2925-4344-8a09-8ae73516191a", "value": "d3124ebd0351481f2f96358a748778e2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0663ed78-de38-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1710004270, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710004270, "uuid": "e6cf0382-3718-403a-be58-d8f8cd197b67", "comment": "Malware payload (Mirai)", "value": "79cabec55b8ffe8ad7a629fed2456e94", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710004270, "uuid": "b9b1cabd-66f8-4790-8fe7-5eb711705c6a", "comment": "Malware payload (Mirai)", "value": "81092306bad3577742681d4d9647e34d96026fb53097210eef0fdb739d9c5f81", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710004270, "uuid": "1af566ce-0745-4fc0-bf25-fe4ab2c704f4", "comment": "Malware payload (Mirai)", "value": "9b7c307e4f0d05d05f94f6afea016617b472b3f2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710004270, "uuid": "7b30f044-1ba8-4fb5-9e31-0d73c89dc725", "comment": "Malware payload (Mirai)", "value": "41eb8a1f696b9bc16d5541a3c97f1907c8833f270642f269a70edeb15cbeb12aa427d31c43a3870b286b6062abf49afa", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710004270, "uuid": "579d8c69-458d-406b-9c56-fab91610a3a6", "value": "T19B238E67C42C6D94D15986B8BD248A3C6B13D405A6D33EF6774785A29083FECF60A3F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710004270, "uuid": "33299618-47c8-4e5c-a033-8c49c7be6ed0", "value": "768:3/eJNsyDbw5AMOraOwtg1UMKmqxrqB3eNQ4qpuWzN0g+cCnoJCnCl/E:3/6sGEcaOwtg52qsmv73fEnCl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710004270, "uuid": "6ddd18c0-dcbb-4ef4-b55a-9dcad579f8a2", "value": 47584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710004270, "uuid": "bc2cf458-5537-4754-8e72-2cdd84471c28", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710004270, "uuid": "b3e7fdf5-383b-4d39-9213-b9a4a0051701", "value": "79cabec55b8ffe8ad7a629fed2456e94", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b85eb44d-de19-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RiseProStealer)", "timestamp": 1709991254, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709991254, "uuid": "9e42878b-e3a9-4ebc-aa1d-4da228e98d5c", "comment": "Malware payload (RiseProStealer)", "value": "06f41dd95bb2b8233cc585f9fc482aa0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709991254, "uuid": "9eaeb075-13f0-4ea0-a260-755edb06c865", "comment": "Malware payload (RiseProStealer)", "value": "81c0945d4db037e8261c1d19704db3aaf3a80dbb5b8b1bea8b9d4face75e1e85", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709991254, "uuid": "d7f10076-177b-4605-be89-56dac9aec343", "comment": "Malware payload (RiseProStealer)", "value": "243fa704e41932fb122b392bee7b8f3553dc43d5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709991254, "uuid": "ef6278a3-310b-4b10-886d-20d27b9bb4d2", "comment": "Malware payload (RiseProStealer)", "value": "dc0b671cee9279a74a7cc89f2d5d6c5a6bcd0e182ee1ac3487ad7ac2d4f0437a9538849d2d86b021c1b03e34061ca148", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709991254, "uuid": "f3fd49d0-58fd-4943-9e1c-e0d76ac3ed33", "value": "T13456330D968281D9C9AEF3B0531EFEBD75B71F8942629C5A94196FE7D8F34023272903", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709991254, "uuid": "8990bce9-3c3b-480f-90ba-7d1f788b9714", "value": "9a5cb4773210cbe1536aa8965a6904d0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709991254, "uuid": "e3909d00-38ca-42fd-913d-39e261196b9b", "value": "98304:/Ie1b23X8WOIIaxKUpGjHmRniM5HO8gKMMHCN2G78TAkgWxbr65twZUxz:HqX0ixKUoLmNFuDKMoax78CCD4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709991254, "uuid": "3b6c66ea-7be3-4d47-a233-4f8f5eb6c095", "value": 6278656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709991254, "uuid": "fcd15d02-fb74-496f-92c5-101283e67f94", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709991254, "uuid": "9d795bc5-5c2f-492a-8411-2282c05a4a7f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a99e57ca-ddfc-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1709978774, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709978774, "uuid": "434c0bd2-6e92-4dd0-b795-34eb03dd6388", "comment": "Malware payload (Mirai)", "value": "8b74df1de688672ac1c002f7cb167735", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709978774, "uuid": "a4ea0e7a-da5c-4d50-b4c9-51db16953e0d", "comment": "Malware payload (Mirai)", "value": "824e5f7c8bedcc556f92badc256e00490bc0af46b69cae60e82d007ea3b6c02c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709978774, "uuid": "2e6e62d6-40c5-4e3a-bc2b-003f17d2cce0", "comment": "Malware payload (Mirai)", "value": "28ffb2d71e71c6fae1832103d252702172e97ff9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709978774, "uuid": "cc96fb0b-b694-4d80-9aba-d6bc586222da", "comment": "Malware payload (Mirai)", "value": "66c5f1ad3c31ce53d8fca60863d899ef4a8864d78412b2db50251531b9f2121b201446b471c0ce1a099798a2d9c2d4d0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709978774, "uuid": "e01c1b6e-6a11-4b53-8d16-a29875d94da3", "value": "T124E329D7F800DEFAF80AE33748530806B530B7E245925A372257797BED3A1991867E87", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709978774, "uuid": "1a9af8b3-2db5-4499-aa86-11a67fee1f43", "value": "3072:eVIrNcDhb7+nRuApVnAw3KkZI1Vrjbi7LDdYwiysg59O:4IrnBp1AwFZI0LDdmysy9O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709978774, "uuid": "218ed708-8ba3-42bf-a33a-4340735d8e83", "value": 150464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709978774, "uuid": "59ada7ed-2d47-46b3-8dda-24e9b020df90", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709978774, "uuid": "5c6b902e-3a9c-4501-b433-3369d0812955", "value": "8b74df1de688672ac1c002f7cb167735", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f1e4f14-ddfc-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1709978756, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709978756, "uuid": "142e2282-1fdd-4934-ae24-66cff292a128", "comment": "Malware payload (Mirai)", "value": "06362a1a45b8a08f716ab95f75c4fedf", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709978756, "uuid": "0c6df134-721c-4f87-99a3-a89709e0535f", "comment": "Malware payload (Mirai)", "value": "829b127623292fb9bb76f46bec2805817fd1e7740f8dbc39e3678beb45757fb8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709978756, "uuid": "c18f6e64-9bf9-49d6-be53-ed8af7247bb7", "comment": "Malware payload (Mirai)", "value": "348d3ade16bee05668754b5f43ee6cd65c3cbb25", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709978756, "uuid": "10964e4a-915a-49ce-b85b-42335bd66f9b", "comment": "Malware payload (Mirai)", "value": "4dc58f6e5e294f7a43c9da518f331e3cddb9ee9938edb702cf2758e9da640a69ca52b164c23a23e4ec100048eb2983b3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709978756, "uuid": "44794d52-bb8d-4dc4-9355-cbb45419b184", "value": "T106B33A0798615F77C045ADB129AB5530072BBA120F8F1F99B57CAAB4074F8CEB40FBA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709978756, "uuid": "ff0fc016-e3f9-43c0-a958-7f1abbe47015", "value": "3072:j3T4aejS4yYF8dQy5hLwzzqULkY0Px9gQNfR:j3Up+X/Qy5hLwzzHLkY0Px9gQNfR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709978756, "uuid": "3e588ce2-261b-4fd0-a079-6a77c6c3d27f", "value": 108427, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709978756, "uuid": "a3359881-1b9a-4987-8edf-c17639754d04", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709978756, "uuid": "6ead339c-efbd-42f5-b1f6-47f7d38deccb", "value": "06362a1a45b8a08f716ab95f75c4fedf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e91b93f-ddfd-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1709979185, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709979185, "uuid": "47527eb8-4d8b-48f9-a586-c53ee546d38e", "comment": "Malware payload (Mirai)", "value": "72ea7803237b0993e89bb5b02a9aa423", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709979185, "uuid": "e48b8314-0609-444b-9b60-d5fdcd0cdbe1", "comment": "Malware payload (Mirai)", "value": "84c8156cd70f38fabf28f412aa43e64035a84446c79adaa8a328aad72137946f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709979185, "uuid": "b7770fb3-7f72-4fc7-9154-379210f6c349", "comment": "Malware payload (Mirai)", "value": "f47fcf64ef3f44778fd0b079d293ac1e37c6019c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709979185, "uuid": "1b79008a-dd6f-4872-bec0-a1d80f8bf5d6", "comment": "Malware payload (Mirai)", "value": "76c0f58bd3bee67d348b35c65cba447e1966c23c0c8b9f93e2e2bd0cf2a6fa1e4cad8aedb6acadb0e8024ad7e4ad487e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709979185, "uuid": "91ae91a6-23ed-4653-ba2c-8fbefe7d3831", "value": "T10BD32A05B30C0A47D2632EF43A3F67E093EFDAC121E4F640256FAA8A9172D365585EDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709979185, "uuid": "7f655c66-d4ab-4326-b7e2-5299592a31d3", "value": "1536:6ApYWLEkcvb5I/Pz+z1kyxgxpzvTLLNsoghM8gzLPMvgvAVIRc732d3qSC5Kgkmn:uOPzakyxgx97fR8gnPMNVcm7jjC0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709979185, "uuid": "4e358a49-d54b-4884-9eff-1638f5cfa7d6", "value": 132344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709979185, "uuid": "a99499ff-1b0e-4fd2-a325-c2af09ca4fa2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709979185, "uuid": "5e9893a1-c180-483d-814f-c4c3673f2ec6", "value": "72ea7803237b0993e89bb5b02a9aa423", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfccd1c0-ddcc-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Adware.Generic)", "timestamp": 1709958195, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709958195, "uuid": "dd923ef6-09ae-4e80-aa6b-269468e899ce", "comment": "Malware payload (Adware.Generic)", "value": "d989d04d1a8ec83ef70017c7df882a43", "object_relation": "md5", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709958195, "uuid": "ae36b3b8-2ec9-4a66-a1ce-37b16c2551f1", "comment": "Malware payload (Adware.Generic)", "value": "8692d4f7cd68e706385f9c9cfa4f63cbd15bf560bfd091652498ea067619220d", "object_relation": "sha256", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709958195, "uuid": "acd066e7-9ab3-4bd5-9301-c0b9d0eec0af", "comment": "Malware payload (Adware.Generic)", "value": "945bc65c45a52565655de9b3aab12da69835a43d", "object_relation": "sha1", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709958195, "uuid": "bb8b30b4-39eb-4129-9418-cda4a5788143", "comment": "Malware payload (Adware.Generic)", "value": "9bd53cd48781567b17b669c4d0e5887d14c08d83890b21d958ee83c746c9b3450c21a0333b22c42f9ef6cfd5357e9d8d", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709958195, "uuid": "fdf0c085-5f07-45ff-804b-bc5ec2d1fc4a", "value": "T193B6233FB268263FC9AA4B3509B39250AD7B76A1A81B8C1F07F4055DCF264702E3F655", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709958195, "uuid": "19d2096a-84bf-4ed0-9020-a83bd3d6786f", "value": "e569e6f445d32ba23766ad67d1e3787f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709958195, "uuid": "6e4c9cef-535e-4590-b66c-ef93faf1b349", "value": "196608:dwBV1KyVq99GEnKGjaAGjC+4apZBnEpu7dmZIw2813/3hzLc/MF2fY25m:AAyVkG5KaAGjTTEpu70Zdd/3JSMFhB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709958195, "uuid": "fa622bc1-ecd4-432b-841e-185d0dbaf943", "value": 10767614, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709958195, "uuid": "c25b3609-3726-48ff-83ab-d781c57f8107", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709958195, "uuid": "8bd49797-0cd7-4e33-aa9c-c3a10242f844", "value": "SecuriteInfo.com.Trojan.Siggen21.10427.8927.13410", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c2aec63-ddfd-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1709979154, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709979154, "uuid": "88c64cea-813b-4940-b5b1-dbf7773d68c3", "comment": "Malware payload (Mirai)", "value": "e1b17a0b4fdc90d16c2754404c0baf0b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709979154, "uuid": "5c72100b-7eac-494c-940a-cec334313db4", "comment": "Malware payload (Mirai)", "value": "86bba4ac3366d5b51c85f0fcb17e8ad34b3fcecee9f812a0689630db952a6b89", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709979154, "uuid": "95ee0426-7d73-42c9-b7f3-fd3085f43bce", "comment": "Malware payload (Mirai)", "value": "2c8706a95fb36b7bded1d3b8928b7338454374c1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709979154, "uuid": "f733fb89-6153-4236-9f2f-7b3993935ea9", "comment": "Malware payload (Mirai)", "value": "362b5a7fb77f3bc5af3e94ad2123128aacddf154af7a178dfe243138f2c905a0bcf0ce51b3680270a90b853f3c1c1bd4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709979154, "uuid": "cd3a8d48-7c51-44fe-a60d-4a2de9b4b71f", "value": "T15B434C0333280E07D9961EB0353F0AE093BFF95126F5B68A194F9B758639E761082F9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709979154, "uuid": "22168245-4c57-4857-bcd9-4980e66e0bc0", "value": "1536:q01NDkjhWBPe1ZMaDy0wYrudk/GrKd42+P:qEgoBf3YrucGqK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709979154, "uuid": "6c0d1198-6314-4348-8370-c3ae5d942ca6", "value": 59960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709979154, "uuid": "7600ecbc-0892-4a5c-8243-537776b8aad7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709979154, "uuid": "e80be396-f38f-4e90-b1d8-1f0709d5989e", "value": "e1b17a0b4fdc90d16c2754404c0baf0b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd73c6ea-ddf4-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Amadey)", "timestamp": 1709975371, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709975371, "uuid": "13b20246-0c16-463e-9a65-dead80e58cc4", "comment": "Malware payload (Amadey)", "value": "bf96089db18744fd1f5ccd30526bdb73", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709975371, "uuid": "a32c6bed-309f-4345-933a-3b8fa93f2f49", "comment": "Malware payload (Amadey)", "value": "8733c0c0b2a40c48919a925d770ae3ef634f1878ee1e608313697269945f7eb3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709975371, "uuid": "2e665c68-a955-4783-b720-b052f642f25c", "comment": "Malware payload (Amadey)", "value": "f155522a68f581597f04dcf4e8e473bbbfca9324", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709975371, "uuid": "d02e7423-cce4-4f00-8db3-783a38ac4a54", "comment": "Malware payload (Amadey)", "value": "5e76bbde7bf2465f1a019629b11bed4bb7ae4f281a7a2f8d6ea8a112becde81a2a6d3b923f081da30c0830ccd836dbd3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709975371, "uuid": "3907f012-e49c-4fd9-8d4a-ba68af4e5c5e", "value": "T16B0523522324C177D1A58CF76AFCD8C25BF2B523B4FA420B2625920DF613FC16A4D726", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709975371, "uuid": "35896781-d886-43e3-923d-2f530e2861a6", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709975371, "uuid": "083424f7-7b49-4e7f-9ca5-b52bc54ada15", "value": "12288:yN2OavIWI2gWrMyC3q8vr1gAeWNVDOLQbQF1zaOir036Rc10sjlkxIWjW+EID:yN2zgW7u68DTNROsY1VE0Q60PBjW+n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709975371, "uuid": "824abcda-a5ab-492f-a280-6288740c0eb1", "value": 821464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709975371, "uuid": "1c46819b-cbd8-4021-bbc2-16419282f4f8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709975371, "uuid": "f58adab6-43d7-47e1-aec6-14f38c1b380a", "value": "bf96089db18744fd1f5ccd30526bdb73", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9883631f-de02-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1709981322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709981322, "uuid": "9a512e83-7403-491d-8751-935a90a1367b", "comment": "Malware payload (Mirai)", "value": "372381721a9e9456518e22d285ff3c91", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709981322, "uuid": "f270f475-86cd-4f55-aaea-835fbf676d36", "comment": "Malware payload (Mirai)", "value": "878c64c2040b1e1146c95ac6bed5e0a8e429cbd072b7c186493163fd43fb9446", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709981322, "uuid": "21b3f47b-99e5-4e31-833a-f15254775103", "comment": "Malware payload (Mirai)", "value": "7acbf91b3b927c8bef506f93b9f2fad2c4e9cb5b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709981322, "uuid": "292750fd-31d3-4da5-b67e-9617b8aca045", "comment": "Malware payload (Mirai)", "value": "d3ea62d72f5ef7d5adfa81ace4e79ad0dec670af0f6c7ab6b589780afdaea8e55e0b9aca0542740efd1077166c5b8967", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709981322, "uuid": "076b009a-6665-4e40-814b-ebb376dd73cf", "value": "T1FD04881E6E228F7DF66D873047B78E259B5823DA27E1D640E1ACC1105F6039E641FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709981322, "uuid": "d69e9a2c-2f38-4981-9270-2f83021fc310", "value": "1536:T16zePrQiQY3iY05Y9vt6Sw6cFL+z14R7oOe/3LM76qfTOSV2dLi6jyfjBdN:TnPvQV46SKFahy7ox3LIS4OLnyfjBdN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709981322, "uuid": "213cff17-d7cb-4810-bf10-05631164c31d", "value": 173824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709981322, "uuid": "612a678e-b565-4733-ac5e-9cdbda99cb1b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709981322, "uuid": "4269d7db-7f71-4cfb-8461-f4fa3e6c7367", "value": "372381721a9e9456518e22d285ff3c91", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ac94754-ddb5-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709948201, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709948201, "uuid": "55e9028c-fd54-49f1-af7a-b8a996d325e1", "comment": "Malware payload", "value": "27052bfcababb4166555f46e73c5b870", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709948201, "uuid": "955460d3-7dfb-4dd3-9660-75e50ee0d72c", "comment": "Malware payload", "value": "898fa7b3c1d471fe700f79acd9d13f9e4c58773a43bed356b5425ddf8895a57d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709948201, "uuid": "037fa55b-3030-47f0-a755-11603db33fa6", "comment": "Malware payload", "value": "be36d76785d597afaeb5dedd9aaf972e2712abf8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709948201, "uuid": "c7c7c544-dfee-48d6-80c3-4209cac4bf78", "comment": "Malware payload", "value": "a5990fbd572fc9538719d05f9525bf818821a048e85fc634f0095058a8c82400d3a15d0904392d8f8780e5f5616bc76e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709948201, "uuid": "5e370fb8-db7f-4819-8cfe-79b7c8c211d8", "value": "T17BE73374CEBE88F2F99D3CB614D043399965AD604C355081C66BB0DAEAB3D87DE084E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709948201, "uuid": "f340a3ff-1447-4518-9086-381c14a52224", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709948201, "uuid": "539811d3-93cf-4d3d-aeb7-8df736111087", "value": "1572864:FrziNx5qUER4jzEDZqJ1UUMpMP59xb/ThZ0s8sk5DiPf7:Qx5qHRWzEDZqJqUsMB/Tj6DUf7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709948201, "uuid": "f08a929d-98ad-4bcd-b36e-cbacd02d2144", "value": 69330598, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709948201, "uuid": "763adcbf-973e-4b3d-b019-f107ddaa48f3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709948201, "uuid": "f6f69950-efff-451a-9a44-accc0e7de9ad", "value": "Google Digital Marketing .xlsx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4784c27-de37-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1710004213, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710004213, "uuid": "2acb8647-9f30-4fd6-8dca-22de5cdb5a57", "comment": "Malware payload (Mirai)", "value": "d42a572b436c92dd73a49f79026755a3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710004213, "uuid": "bb7dbb2e-57ca-4095-886b-c4d106959ee9", "comment": "Malware payload (Mirai)", "value": "89a304385ad82fe5db1645e222517e69f0da9f6ed29ba7de2078379241fccf42", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710004213, "uuid": "3c68f176-33d9-47cc-b0e0-4f0e4863e98f", "comment": "Malware payload (Mirai)", "value": "e19d5be21c534c44cf3af5a6392b40d3f0d44167", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710004213, "uuid": "7b534cd7-c048-4a44-b88d-06f2b6be346c", "comment": "Malware payload (Mirai)", "value": "6436c9bb5783b32a49c8770abe7b0f48bf9b525ad2420d476a437a6cca0041ca1f2bc27a3f14759817156d29ac5ae30a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710004213, "uuid": "696a0244-6e16-43ec-90ce-e050c44159f7", "value": "T1AB639DA3C9396E98D1A892F0B4349F745F23A11082A71FFB0E55C1799087EACF6463F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710004213, "uuid": "c0326f31-a183-43ea-9bad-bd92fa10a8bd", "value": "1536:datwtVAbFF/lAKLLwGpqKh5EHBmESiCXwHWyPASi2:dqhbn/lt/wGjhSmESiF24d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710004213, "uuid": "f6b65986-4875-4e4c-b6f6-ef85a700d4d4", "value": 67072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710004213, "uuid": "7ec23288-a3f6-4ad2-9dd9-173d9fe03a2d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710004213, "uuid": "fd641f23-f9b0-44b8-ab43-f9004abbb648", "value": "d42a572b436c92dd73a49f79026755a3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75df71fa-de5f-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RedLineStealer)", "timestamp": 1710021207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710021207, "uuid": "aecf6e5c-66a9-43f6-9b1a-bc5c6b4a1b05", "comment": "Malware payload (RedLineStealer)", "value": "96ad06b20362f378e5f81edf6dd968ef", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710021207, "uuid": "0a168f31-c81d-48cd-bd01-168f4ebdb1ff", "comment": "Malware payload (RedLineStealer)", "value": "89f3819c63fe7079db92866643e3f2e3b1a04c653c04411b630c72b8082c35b6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710021207, "uuid": "c157e805-11e2-43c2-a1c4-a868b9c82b28", "comment": "Malware payload (RedLineStealer)", "value": "7feb5233a0c1a1a9224cdbb8cf03d62cd99cf32a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710021207, "uuid": "4fdebe75-9981-4b51-8b53-1276b1c3f709", "comment": "Malware payload (RedLineStealer)", "value": "1ca6f566e7d2958b9767fce25fc0b23fbaf9df806a75c30ce352c9f367a00d97e59fc8219480114233f2782f1c8eea4a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710021207, "uuid": "54d5cbf8-c79e-4f66-beb8-e1a95d669e43", "value": "T1ACB41202D2FC47E0DFB94BB96D91700397B2A6829A70CD7A1C9594C8A8A375407B9F4F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710021207, "uuid": "6c2e408d-eecb-4024-ae35-da1506732e3a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710021207, "uuid": "25595a94-ffea-4742-9085-b4f8b5510ceb", "value": "12288:eXbcmn/22sMbf0poapqLDzXAYwAg2OXgkR:jmnOGMXWDzX4Ag2OXH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710021207, "uuid": "277717e7-3ec0-497c-b842-f98c17ffbaa0", "value": 517128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710021207, "uuid": "e4b01788-3e22-4880-b74f-85d876a88410", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710021207, "uuid": "b26c762e-360c-421d-9ef6-425585442270", "value": "96AD06B20362F378E5F81EDF6DD968EF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b75216b7-de37-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1710004137, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710004137, "uuid": "1df5057b-3a34-4730-91e8-d00c36ed4568", "comment": "Malware payload (Mirai)", "value": "aced07a8fb7f7a9f8768555968998859", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710004137, "uuid": "4b450ca4-a39f-4377-9c60-580c796b348f", "comment": "Malware payload (Mirai)", "value": "8a80bb38a2bf862b29a4463b1da87ccf7d096193ef6d0d9479525c4de5050bb1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710004137, "uuid": "af3322dd-c759-4f33-b81a-9c8e75bb1ced", "comment": "Malware payload (Mirai)", "value": "43f6d1c0557194f2ab4257d832a3ed0f3863b6ea", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710004137, "uuid": "e941b71f-283b-40c5-9e02-f5243c61ab61", "comment": "Malware payload (Mirai)", "value": "bb3a3da689a1490b45e9ba7dd7654fd2878bdcf5ebde260aebee5e54fd46b598077c6f843e2cc45363697f553ea74511", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710004137, "uuid": "58a96a35-b711-45c3-ab61-0400dc252253", "value": "T12A833AD7F400DDBDFC0ED77B4453490AB671A3A156831F3A23A7B963AD321A44922F82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710004137, "uuid": "15039a4e-4d3e-4818-9280-abbb1d9a9bad", "value": "1536:QFbJXSyRRpM4Lwlu48kyFVkxetPCgXapI4Tz7n57jtGZEoISY:ObJCCm4LwluyyFVkVgXQIGxtGZzhY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710004137, "uuid": "f6adb719-726a-4d40-8688-d1ba2438b1c6", "value": 85256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710004137, "uuid": "387b88ab-c18f-436e-ad56-3cddd42416c9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710004137, "uuid": "972e2034-346b-44d0-bf7e-daaa41c79ede", "value": "aced07a8fb7f7a9f8768555968998859", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2129737-de0e-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1709986546, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709986546, "uuid": "6a611576-b646-48b2-be6b-c76f090c12b7", "comment": "Malware payload (Formbook)", "value": "0f12279a0c0b3d9e7a9987efa2133cfe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709986546, "uuid": "682669e5-893f-460f-8086-b54940cc4167", "comment": "Malware payload (Formbook)", "value": "8a941016aa8c0a90681a0558467f0d30d9d12b692e7d20159c9defbfdac5c40e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709986546, "uuid": "0a6358f1-8736-4ed8-9e24-004943ba55f3", "comment": "Malware payload (Formbook)", "value": "25c932797182250304ade347140a4159a468268d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709986546, "uuid": "1cb671c8-6c38-40b2-911d-77e2f6e3c542", "comment": "Malware payload (Formbook)", "value": "49339d77d56a0609b20b74efa8cfaaaec0fd15c318c071f052e15467457071d328f9025171d568c63b52234241bf1d3d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709986546, "uuid": "35e4793b-8a54-4d36-a3ad-2cb4a8f84a5b", "value": "T10135AD0273D2C036FFAB92739B6AF60156BD79254133852F13981DB9BD701B2227E663", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709986546, "uuid": "dc2bcae9-5cbb-43e0-9b47-8cf313ec2ecc", "value": "afcdf79be1557326c854b6e20cb900a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709986546, "uuid": "84d1c46f-8018-49b1-9184-09967545b73f", "value": "24576:RAHnh+eWsN3skA4RV1Hom2KXMmHak0J24TPAkAXDn7c+45:oh+ZkldoPK8Yakg2aFATQh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709986546, "uuid": "1d7693b6-cdff-42d6-b80a-63eb38cdadd4", "value": 1115648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709986546, "uuid": "fb7268ae-f911-4c91-ac11-3d6891fc720f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709986546, "uuid": "8ddaec8d-5954-4993-814a-f6d1ddb1f580", "value": "Ziraat Bankasi Swift Mesaji.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f78eaea4-de36-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1710003815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710003815, "uuid": "d85984c4-8aea-4203-9799-bbd12741c8aa", "comment": "Malware payload (Mirai)", "value": "2251da511a778e19cf0f3c749e2f900c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710003815, "uuid": "beeb3c31-b93d-42fa-89db-1f68e9fea071", "comment": "Malware payload (Mirai)", "value": "8abb2a2f66564461518edaa7d21140ca38e2fb9b80e905ac2bddf043ff1dd777", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710003815, "uuid": "7d63ee2e-5181-440b-93b3-8dd81ed3be89", "comment": "Malware payload (Mirai)", "value": "9f77f35c8e972a4efbffd093ca7b540e37d2515b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710003815, "uuid": "6f54f841-287d-4dc5-9dfa-41caa0528b79", "comment": "Malware payload (Mirai)", "value": "be6f1779ea1863f9fa405e0a0b889b4bc76414b0e071ccf1b01dcda66151f3992489f29ebef29d1c32e77d1e52283ff9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710003815, "uuid": "6e811991-f303-4cec-a774-c37a8c5c566e", "value": "T19D533D96B401AD3CFC5BEABD40165A19FA313B3016A30F5B9BA7FC839C321A6DD16D41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710003815, "uuid": "89ffe8f1-db07-424e-8c57-86e80fc22a35", "value": "768:neT+6JhUvtNaEVG1xPgj2x9+iGCvYN1ul8yXLyCIlqXxXv2XWFyN:nInQvtNFG1xIjeWvNUl8yXx2qBvyPN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710003815, "uuid": "ad03de27-6fa2-465a-ac5b-52ab07a9260f", "value": 61432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710003815, "uuid": "4d8a25dd-d597-45e5-ad13-fe5149433543", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710003815, "uuid": "2173211b-8846-422e-850c-b043b3b6eaa0", "value": "2251da511a778e19cf0f3c749e2f900c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7f26f65-de37-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1710004192, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710004192, "uuid": "76527532-a049-4d98-9461-580ec236c1fb", "comment": "Malware payload (Mirai)", "value": "0a8f2b34fe8385c311ac93500df9dd3c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710004192, "uuid": "8e269364-3c93-4418-9d6e-16cb0360af2d", "comment": "Malware payload (Mirai)", "value": "8b37edad7dd834e63c7ee19016d5e5d924b66e527d909293780eaf931cadc88c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710004192, "uuid": "90ad1253-4a9d-4fea-bc4f-18848c16ba3b", "comment": "Malware payload (Mirai)", "value": "08e607be6625469fb3c4134188f5100f916cbd5e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710004192, "uuid": "8ee33d4f-1358-4e13-82bb-072e0aaa579b", "comment": "Malware payload (Mirai)", "value": "597ddc0789df9725e241bc0f28142a7927efe11c48b447c4906183127e9a9ef2504f8981c0b5a4caa3d91bb5246cf797", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710004192, "uuid": "064bd525-e764-40ee-8330-02ffa7b32f75", "value": "T132331856BCD29A6AC5D063B6FA2E419E3311A3E8D0DF3217DC604B1477CA51E0DB3B92", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710004192, "uuid": "05126d94-78af-48aa-bd37-53dc44c9a0f5", "value": "1536:I4pxWxuRmXsWZ6PNX1urVocGgaBrj2yBWrt5vne:lpQQmXsWkRB3ebvne", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710004192, "uuid": "2b4bd870-1635-4820-a7a8-3601862ef250", "value": 53328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710004192, "uuid": "e785e1e4-a82c-4dfc-a94e-bb0b87f29762", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710004192, "uuid": "e97696a1-31bc-4e01-b3a7-c119ac228a5b", "value": "0a8f2b34fe8385c311ac93500df9dd3c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1aa53bd-ddc4-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RecordBreaker)", "timestamp": 1709954709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709954709, "uuid": "fdf52a75-4f17-4b87-a756-0f26ea5515fa", "comment": "Malware payload (RecordBreaker)", "value": "d2d589d4600dcded8b770e84cf64b1bd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709954709, "uuid": "e997d1d4-b75a-4560-9b89-082b1f7f0d11", "comment": "Malware payload (RecordBreaker)", "value": "8c47d27a1595e728278ae9c5842d69b3624d990e7cfea35dbdb9c5950839453b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709954709, "uuid": "76e4be09-53e3-4220-b8cd-3d11e86c3e72", "comment": "Malware payload (RecordBreaker)", "value": "33ce3a13017928086916b3b0131e693a10b5d9f1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709954709, "uuid": "b08675e4-2ee0-4652-b904-533e6db6e6a6", "comment": "Malware payload (RecordBreaker)", "value": "2715c6c93b5ac399e1d2e5e01a4185fa838a11402464374412f723f5c5f839d919310c67cc58c05ae43e8d80562f74d1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709954709, "uuid": "3a79ffe0-5aa9-4727-a512-421b770acfa4", "value": "T10807239A68C780FDD9C128F0C61F26E703B16A774A8848287EC57D46F5B1F76607AC63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709954709, "uuid": "f95c425f-50ab-4785-b291-b636ec9045cc", "value": "8bd40c884ea05114a0b9250b78831096", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709954709, "uuid": "55fc30d9-d8fd-4581-be46-3ba8aa67eeea", "value": "393216:NhnPOiP92jfq+5wVVEuVEGcFBZD3ffQVh2uQ:HlQfv+6o1cFBZPoVsD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709954709, "uuid": "abc9b09e-a4e5-47d4-ab29-402059ed6eab", "value": 17581056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709954709, "uuid": "6179f61c-9479-4fa9-b897-c565200872d6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709954709, "uuid": "c0b5e2e8-4e1c-4bdf-badb-f907b17c82dd", "value": "D2D589D4600DCDED8B770E84CF64B1BD.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f48eb0a4-de19-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709991355, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709991355, "uuid": "d04f74a4-f78a-45ac-ba44-0e858a29ec24", "comment": "Malware payload", "value": "a25ef8a699f60f3161f990ab39740c4d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709991355, "uuid": "66432a9d-2fe9-4e95-8ef5-871bd1348ce6", "comment": "Malware payload", "value": "8ceb862195352f9d2253994cde123ee62bb9793522ec30a22c960546fb8d7398", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709991355, "uuid": "83a54d3c-86de-4793-8591-ae4f3d857f2a", "comment": "Malware payload", "value": "92c1914ab2e731ac3fa0885fbf36e303dd5c3ec3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709991355, "uuid": "4e52cbd0-7514-49ee-8837-ec94393a8fb3", "comment": "Malware payload", "value": "d284d0d357ffc5a99e4767c3d2891140ea019290778bb2f7f5d376b0978203150ea5ca4906ddc3e8fddc25c616e54301", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709991355, "uuid": "36ea26bd-39b7-460b-9c7d-764b2aae5f63", "value": "T171D63356C51204C7CF45F57DC6E3EFAC44DA26EFA89210DBA94EA01D66A337E22DF420", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709991355, "uuid": "33202b4e-853a-4b21-bfee-3195a1118733", "value": "b427d89a0dadd4b0bbb0f5db8a225af7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709991355, "uuid": "167edaae-9064-43ca-afe8-21aca00a3ac1", "value": "196608:YvpGEvvePOKI2hldfSUBpzQSKP3Iyx/C0ts3IcXcmwxyby+aOVki86rkB3N7ue4N:SpGzOX2h6UJKH6QhGcmwxQDaG/nOhuT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709991355, "uuid": "6057a6be-de74-4d45-9a69-f1ad466e99cf", "value": 13834144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709991355, "uuid": "c4aad3a8-c502-4f45-bf54-7c8e460f3430", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709991355, "uuid": "3c6dfff0-7ad2-489c-9d0c-da00a3dab9d6", "value": "SecuriteInfo.com.BScope.Trojan.Ditertag.22041.3184", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc70cfe6-de15-11ee-b7ea-42010a9c0006", "comment": "Malware payload (LummaStealer)", "timestamp": 1709989650, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709989650, "uuid": "c5a23874-f99b-4370-b290-7a25b1265aa2", "comment": "Malware payload (LummaStealer)", "value": "3c2d0c5d689064e5b679239e3391f724", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709989650, "uuid": "b0770e9a-d705-40d9-b307-5ab5c1045026", "comment": "Malware payload (LummaStealer)", "value": "8d1bf0457221a66c9f2ceee9639aac4301bd1e49042d2ae6c25ae7009cebf258", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709989650, "uuid": "04bcebae-6a5f-4208-af24-af4fb28252ef", "comment": "Malware payload (LummaStealer)", "value": "2e7fa496b7418c5f28091b57c2a98444d750c0b3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709989650, "uuid": "3727c2d8-8384-44d9-a22f-b004e4683d80", "comment": "Malware payload (LummaStealer)", "value": "ba639f981b4bebe5e55c9cf1881577816d553425399d635c087c62ca92cf73f139e24a2c4acbcc258272f72499e6d030", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709989650, "uuid": "be6b14c9-5dd5-4c5e-935b-55dd7f681c0d", "value": "T114A4CF9486BAC627D6EC4379A0925219FBFD4107E622E359982450F01C263D3FEA376F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709989650, "uuid": "821a0e81-eb2e-405d-9275-83ee574bf7ed", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709989650, "uuid": "6aea78ed-b236-4297-803c-84a7a33aa0c6", "value": "6144:ivHD0InJyebWRJHza0XION0KCZ79SnfmmSK3stYDpsAxngnYlfqbjgfMn2e9/H3/:ivHDRbYJHza0P0KCWfJEtWr+nZjTN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709989650, "uuid": "f089a3b5-1b0a-426b-a548-39ea128466f1", "value": 459776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709989650, "uuid": "2bb5b935-9737-455d-8188-f761f8e61814", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709989650, "uuid": "f62fd69e-8f9e-48aa-ae7d-5560c0202375", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2621f54-de37-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1710004156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710004156, "uuid": "4e730946-06e8-4ac3-bbe6-70e8d271de5c", "comment": "Malware payload (Mirai)", "value": "3f4c371e97757604f1cfdcb0c3b5406a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710004156, "uuid": "d49bb858-e075-4732-83f2-dfe86ed79864", "comment": "Malware payload (Mirai)", "value": "8d7a657d7e3ab0569a4fd866cb0995e2e56d5c2194f6eedf71ce7587753f33c2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710004156, "uuid": "a47527aa-191f-493a-be18-162dce1e83f0", "comment": "Malware payload (Mirai)", "value": "e5b80fa1b4d60de63d5d404bb218fbc56b5b22e0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710004156, "uuid": "2d9a3afd-1cc3-45c9-b078-2141b0cf213b", "comment": "Malware payload (Mirai)", "value": "803d150610e706eac98461fac467591f8a20c134ac0c05c27913d5a13431a1324c93b69513705569508876ff632aad1b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710004156, "uuid": "0769b032-bb04-4bdf-a0fc-25d421d81b88", "value": "T10FD34B46FA418A13C4D513BABAAF41493332D7A4D3DB730699185FB43FC67AE0E63606", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710004156, "uuid": "c74a6ad4-27d9-4f91-b0a7-f63abc4d7d46", "value": "3072:5KacBqVuJVkW1cIOPZoxNOqMP0wctzHnpPF+84/M/92L18Yj:kacBQuJVkW1cIOaxNOqMPVohF+8MM/9S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710004156, "uuid": "4131f27b-df5e-4581-a169-33490b9aaf6a", "value": 136482, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710004156, "uuid": "4e942f15-10bd-448f-bb2d-a296b2eac9bd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710004156, "uuid": "4e727415-f588-4df2-b303-9e98b99af402", "value": "3f4c371e97757604f1cfdcb0c3b5406a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4b89496-de36-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1710003811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710003811, "uuid": "a87f2ca3-ec15-4cb1-bd55-489799eebd89", "comment": "Malware payload (Mirai)", "value": "0240e15f3ced88b2bbc3b0ad80387269", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710003811, "uuid": "0d9d7d98-ee3b-4c10-ba4e-5b62a2d1bb23", "comment": "Malware payload (Mirai)", "value": "8d970ebd62664ee00579f3daea5ac42e83f357d12d2738dda1eb0f35aa34ebe5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710003811, "uuid": "4c88942c-c930-4c7f-804a-d16f782cf124", "comment": "Malware payload (Mirai)", "value": "34a5d188c07df9c0e126ad0a1ac5559fd0246af1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710003811, "uuid": "e7e90bbe-b523-45b6-a485-d16bf3845f25", "comment": "Malware payload (Mirai)", "value": "a0264c7e01aaac337c1728096c8dd9939cec18a21f1912a77aecfad1ebce0c213b2b0cad78cf2960dd64ae1bda094bf0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710003811, "uuid": "bd52de61-758b-4507-9416-698016a01b6c", "value": "T16253E58178919A17C5E422BBFA6E018D373563F8D1DF3216CD226F2476C982F0DA7B52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710003811, "uuid": "31e6a8e4-4083-4263-8fff-6419f571e1d9", "value": "1536:gP1IwP44TCRfNdbYakabDrzKQlG9Wcq8JJTfd42+:gP7V4sazKUG9bqAJT1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710003811, "uuid": "6694b2c4-8956-4c20-8f14-f8e4d20dc8f6", "value": 64460, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710003811, "uuid": "9ef94118-40ab-4585-b565-01c12cd53e0c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710003811, "uuid": "32746f0b-fd0a-445e-ad79-cc8756a4c305", "value": "0240e15f3ced88b2bbc3b0ad80387269", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47130078-ddbd-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Adware.InstallCore)", "timestamp": 1709951550, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709951550, "uuid": "bfbd1ccb-9b3a-4c48-b9b7-d119ae465c6d", "comment": "Malware payload (Adware.InstallCore)", "value": "055d0f8e81a0047a08cb0c7a176154d8", "object_relation": "md5", "Tag": [ { "name": "Adware.InstallCore", "colour": "#35D5E5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709951550, "uuid": "9fdfd285-8db8-404f-9ef5-b4e34a9010b8", "comment": "Malware payload (Adware.InstallCore)", "value": "8dad3939ac0b3554274d325cc996c39804c9b5c28a5de54af695ff5fb4bd9a23", "object_relation": "sha256", "Tag": [ { "name": "Adware.InstallCore", "colour": "#35D5E5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709951550, "uuid": "0967bf1e-c86a-44e7-b2c6-8ef6ba263bab", "comment": "Malware payload (Adware.InstallCore)", "value": "6234a3f061f4094d7f30cc0079b66521ede6c264", "object_relation": "sha1", "Tag": [ { "name": "Adware.InstallCore", "colour": "#35D5E5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709951550, "uuid": "4873b300-588a-4f4c-a160-dd48ded5f69b", "comment": "Malware payload (Adware.InstallCore)", "value": "60be251adb9397c72efc297360a022685af675b196f7de1ce6c8d1966eb52f08cbf9a01faa4515d1411dfc3b3718d377", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.InstallCore", "colour": "#35D5E5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709951550, "uuid": "2c7bc07d-952a-4f85-9764-bfacfd092c8f", "value": "T179863350B388BAB5F92DF7F24DB072378A16AE241E30641574E9355863326DFEF2522C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709951550, "uuid": "6afb79cb-82f5-4cd2-909e-ac6a47c0dd20", "value": "2fb819a19fe4dee5c03e8c6a79342f79", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709951550, "uuid": "e6e7f9a0-f7b8-40b8-92dd-4eadee22f18a", "value": "196608:PL9oCA/dZzMi0LbV3iUrhrLJ0LeYmgJ+N3Qnj6O+VS9:PL9oR/dFMLy4VLJMmgYN3Q5+4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709951550, "uuid": "1e04c630-def8-458e-9aeb-a38a5e912970", "value": 8215760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709951550, "uuid": "6842da13-0752-4b34-a0b1-463b6b1cebbb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709951550, "uuid": "697ae817-a439-43d3-86ac-e309cb3a1fb6", "value": "SecuriteInfo.com.FileRepPup.11020.24215", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9ffdbed-de35-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RecordBreaker)", "timestamp": 1710003309, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710003309, "uuid": "84253b38-d107-453e-b4ce-c953425a3cbe", "comment": "Malware payload (RecordBreaker)", "value": "1a4b749d66f83dd6fbc8f96b90cfd4f5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710003309, "uuid": "1b5e7e76-ce68-4892-9c66-5f35d77f9f43", "comment": "Malware payload (RecordBreaker)", "value": "90dea8f22e9858f2e345f3c499b5ef9c28c161eff15ec7c3cc75e74d0ee1fa89", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710003309, "uuid": "817e879f-b34a-4382-b414-57f0b3364407", "comment": "Malware payload (RecordBreaker)", "value": "6b3781ad094b2833df6f534e25ed7b929828366f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710003309, "uuid": "908a93b9-898c-4bee-acee-a4dee8c1f602", "comment": "Malware payload (RecordBreaker)", "value": "dac7ecd27469c86b68684bc2fb9a0e2ef2b12bb6b454206bc7a30745338b6a85e0a6a626a9ed1c7cf4c100dffb97e7d4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710003309, "uuid": "92b7581c-2e48-488c-b165-e8978d0686a2", "value": "T1A28319C154B14A06E184A87303C3D935979AEE3A18177D83E389E7628169DC32D7F7BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710003309, "uuid": "afa7f350-4cd8-4d30-905f-f76548497ff3", "value": "52fcc5c1bcda70fa4759c08995c5a5fb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710003309, "uuid": "5158db3a-babe-4fd4-9be4-227540d20427", "value": "1536:KX0PI6ORWFPekAZZ0XCkSBIPV1Fn1p06QcKUp3nFqH:9PI6GWpeVsXCLMrxbQOp3FqH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710003309, "uuid": "39707477-a1a5-4396-a2ef-88d825350c2b", "value": 82432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710003309, "uuid": "0acd6ca8-e185-4332-a29a-5ea96452e386", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710003309, "uuid": "29170976-d4f7-4112-ad71-faf8e95c899e", "value": "1A4B749D66F83DD6FBC8F96B90CFD4F5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65f639bc-de36-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1710003571, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710003571, "uuid": "37e07559-8ed7-4970-9039-a47131c37c3c", "comment": "Malware payload (Mirai)", "value": "042336186f156beac421eaeb0cad0b3c", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710003571, "uuid": "40884711-2e17-495c-9231-b3b923b8f140", "comment": "Malware payload (Mirai)", "value": "90ee907f4847013a3c42e7f9292b27b0957e531556f2d610e81864beb6b7c663", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710003571, "uuid": "279f49b2-2a3b-49a5-b415-0221b1b7f724", "comment": "Malware payload (Mirai)", "value": "fee61f0f4f2570be3c2a5fde4b37fb63607d7023", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710003571, "uuid": "3cd646b9-a496-4e9e-8bc5-af06c6f219cb", "comment": "Malware payload (Mirai)", "value": "bf553eeee32d79435d25a9df4f71eaa6b8723df6a905c9b3f186ea674e40e0b55462403bcbef6f66fd574dfdaa085b70", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710003571, "uuid": "e914e007-8022-40d0-abc1-e267b3177a31", "value": "T12A04881E6E228F7DF66D873047B78E259B5823DA27E1D640E1ACC1105F6039E641FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710003571, "uuid": "95767f4e-66bd-464e-ae6f-dc90a2243412", "value": "1536:T16zePrQiQY3VfY05Y9vt6Sw6cFL+z14R7oOe/3LM76qfTOSV2dLi6jyfjWdN:TnPvQ+746SKFahy7ox3LIS4OLnyfjWdN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710003571, "uuid": "c8974498-fa0c-4422-b055-d4c341e330a8", "value": 173824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710003571, "uuid": "173ebe0d-7112-47ab-b4f0-9fad68c9adc0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710003571, "uuid": "5ec8057b-854d-425b-b1c8-dd7e2649dbc6", "value": "vlxx.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51f9a769-de0e-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1709986358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709986358, "uuid": "80de0fd6-db8c-4e0e-b258-93aaf5c4f6c6", "comment": "Malware payload (AgentTesla)", "value": "0603858e620614e6badc889156f4f868", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709986358, "uuid": "b2f0c5b8-1de0-4fd2-b9d5-43cc581b503b", "comment": "Malware payload (AgentTesla)", "value": "922d60e40972c644ff506ce7475a18636afa17abdad800cfaf9fbc413a742e76", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709986358, "uuid": "2a951aa7-3566-483a-bf03-27361ae37be6", "comment": "Malware payload (AgentTesla)", "value": "9e3a8d66b1a788b262f047fc0e13830292911d5b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709986358, "uuid": "37aa92a1-8aed-478c-a1c6-a6884c5583d9", "comment": "Malware payload (AgentTesla)", "value": "b170b0896490b3925a23ef4cc0f283afe47f970e8a75936ee5b3e4d27b32e1ad12f5ee7f65d4c5e86cf59e2cc768c828", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709986358, "uuid": "f715a557-9327-41be-b120-894205cc1420", "value": "T156036C22AA4C1237C9BF42F94C5140C03775E30377D6EBBA9CD651925A837C27AB0E9E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709986358, "uuid": "24dbf4d9-21d7-436b-9cff-11a0d838672b", "value": "768:ORSWgr22fLIXyiTUL7n15OaZdMUUMGq5NgvzRxoIdZH:ORD52fEXyAULxVZdMU1loLHoAF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709986358, "uuid": "f45ff4fe-65bb-4005-b38b-353df7804cfa", "value": 40960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709986358, "uuid": "0f70ca51-9d1b-4a92-b366-87199a39502e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709986358, "uuid": "688c9665-e769-4ae9-903e-0dc5fc1d8c28", "value": "DHL DETAILS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "614f6dba-de36-11ee-b7ea-42010a9c0006", "comment": "Malware payload (MooBot)", "timestamp": 1710003563, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710003563, "uuid": "7d8c1686-16b6-4614-a4b9-ebacb2e3e9d8", "comment": "Malware payload (MooBot)", "value": "3042a552c464914b86c791744d1b1153", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "Moobot", "colour": "#FCD400", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710003563, "uuid": "9fb0a88f-2f79-440b-8cd7-a26bb64b19fc", "comment": "Malware payload (MooBot)", "value": "923b5d27c69f216c4465d77eaac05bee12c02ba786df6f1e1e34c8dae117d6c5", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "Moobot", "colour": "#FCD400", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710003563, "uuid": "fae91e42-036b-431d-81ef-52f55e37b00f", "comment": "Malware payload (MooBot)", "value": "126fdc869cc1ab9e0e26e6031abac1d56d93c857", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "Moobot", "colour": "#FCD400", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710003563, "uuid": "bc384628-9037-4476-b33a-3a8a0bf9b0bb", "comment": "Malware payload (MooBot)", "value": "04240dc37d6de532777a8e6e3b1158c0236b2ab4a3b0701935e2bc64d4280f9aa3d010d5c0924ff4accc9801b363f831", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "Moobot", "colour": "#FCD400", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710003563, "uuid": "9cf7f1e1-0169-4bc8-af1f-3d801c83f31e", "value": "T16AD33B1BB4C180FDC4DAC5B44F9AF53ADD32B1A81238B16B27D4AB225E8DE315F1DA50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710003563, "uuid": "b1f33937-0a97-4fdd-acea-5ac8764f7ce0", "value": "3072:DX+wXNsuOXWYmqnQIk11TosPipRlOaogXk72IElN7Ccw3wEymPd:DX+wXNsuOXWYmCEPuk7u5EymPd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710003563, "uuid": "f1bbf182-0d4e-41b4-9497-293acfb004e8", "value": 139576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710003563, "uuid": "5fb8b961-6fec-4ecc-a20f-99beb39de91c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710003563, "uuid": "e3eaea36-02e7-4637-acde-2e7100b5e26c", "value": "vlxx.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7540153-de08-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AZORult)", "timestamp": 1709984004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709984004, "uuid": "7b59a7a1-e9ef-4518-ad36-7e0c67e32586", "comment": "Malware payload (AZORult)", "value": "d8440bc5507c119b5a7d90f9ca0a263e", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709984004, "uuid": "24ef6242-0110-4c15-bff1-41c6d69727d3", "comment": "Malware payload (AZORult)", "value": "92c37098909f035fa6fb4be4a014423a1520f082f07df0e68c2f880799576f15", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709984004, "uuid": "6e2b4b9b-9f74-4f40-b629-216fc622235b", "comment": "Malware payload (AZORult)", "value": "ba3bc06439cca1e9478f0279256e2181b5fb9ace", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709984004, "uuid": "2c524851-0a19-4712-9030-9c7c246554e1", "comment": "Malware payload (AZORult)", "value": "7258d7cd1840c92ea662085697edd92fd7e6aed5a87b794bfc9cfaaa2389879d2e7fc80219e5f93c6949cf0a77621a04", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709984004, "uuid": "b7b44d45-5a4d-43f9-824e-bcb8d5b6d461", "value": "T1FE56AF13B386543AD02B1B358E67C778563BBE106A268E1757E43C4D3F362813D2E66B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709984004, "uuid": "b511f9a9-354c-4d29-af46-b76b9994afe7", "value": "bb677fbadcdf2eca3595d1faeddecfdd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709984004, "uuid": "dcfef922-58be-4fab-807d-30e4c9273f5f", "value": "98304:vZkAh9E7LtDm+Pd+5Ff+uuD266wFxL2pERaMZK:/3671C1rw7a6RaaK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709984004, "uuid": "69af8d63-b36a-4de6-aaca-ef65c1174770", "value": 6142464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709984004, "uuid": "c21476d0-8cf1-4ec0-9185-da88efed5b62", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709984004, "uuid": "5d6e834b-8d24-4a1b-963b-3523a8115dbf", "value": "SecuriteInfo.com.TScope.Trojan.Delf.24120.10338", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c97623df-ddfb-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1709978398, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709978398, "uuid": "f029a65b-9fd4-440c-9b2a-a663b035c917", "comment": "Malware payload (Mirai)", "value": "1c7b768331881ab8abfe4e7c9aafe982", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709978398, "uuid": "6e4670e3-9243-446b-b631-8b66c9850d6f", "comment": "Malware payload (Mirai)", "value": "92fd1356d37bdae2b1cf67526b12151940f63319add0eb289dbdd4b5789803d5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709978398, "uuid": "e70c4992-d81e-4208-9fce-a3a422bb1eb6", "comment": "Malware payload (Mirai)", "value": "c88b3595b10a4b9f86ddac830fa71170058d7be2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709978398, "uuid": "51e8e595-4d05-4ae5-b2b5-70ab7924830c", "comment": "Malware payload (Mirai)", "value": "b7b0abbd5a892472cd33f499cc8ec5598aeb844eadee22ffe261dcd3314e0e2d70a1787c27e04cb746119ba2c6a7f1d1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709978398, "uuid": "9b53e99e-46ee-463f-9b5e-d0235c25db16", "value": "T1F8534A217A792E17C4E4A07E25B38328B6E5678E32B8C65D7C723F4EFF1066064171B6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709978398, "uuid": "f4881ccd-777f-45c3-bf5d-5b8438070d28", "value": "1536:IDK6bb9lTEFq1X6JySbe7M/Tbrv0kv+pdYm+A:mKQ27be7M/Tc0kN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709978398, "uuid": "ad5e5e55-a062-4eba-8cfa-f88d0b463320", "value": 64320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709978398, "uuid": "11850254-f10c-4295-8924-2190f8e9a5ff", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709978398, "uuid": "9acf774c-c5b7-452a-aaeb-e00b5869a2e6", "value": "1c7b768331881ab8abfe4e7c9aafe982", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c26fe738-de44-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1710009739, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710009739, "uuid": "fa24254d-cd76-4ce9-97c5-5a0455f0af8c", "comment": "Malware payload", "value": "05486b43318507e9b40079ccc015fe25", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710009739, "uuid": "bcadc5d2-db81-44b5-9beb-9fb07e1fe3ad", "comment": "Malware payload", "value": "9314d40f064aed182d1b0910dcc17d215a7bcdfe7fa356202c0f84556fbce9f1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710009739, "uuid": "4eecbee0-82ba-4d81-8831-925fec202275", "comment": "Malware payload", "value": "81b3aca7116005ecb58c0fcdf21365c1e4f4ba98", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710009739, "uuid": "7d96c870-25ad-4af8-a7d6-2dd9b67d40e7", "comment": "Malware payload", "value": "966a87f1249cf866438ffe586838c2cddd0456da9cf2727c0f099fe3b7d7ed3d1a7dcdf9ede00cb4f13ae9aa4f194595", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710009739, "uuid": "9bbfa53a-2f71-41ba-a83c-55aaa0dac65a", "value": "T16144E022B6A1ED35D4D3563908B096E64A7BBC021730538FAB643B3F6E726C09E75317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710009739, "uuid": "0a7d76fa-e25e-4cbe-82f4-e03228c76deb", "value": "07da2ed4731c7bc6bfa80c4250299564", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710009739, "uuid": "72f4bbaa-74d1-487a-ad11-bac940f3c664", "value": "6144:uSZu0R2UaRHtcBVQZrKNF3h54I7G1SOm:zZuLg3NCI0SO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710009739, "uuid": "967b4394-a209-4dcc-8d74-d6a5e1001634", "value": 267776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710009739, "uuid": "d1852ba6-9737-4bba-a3a5-c0068c709c1e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710009739, "uuid": "c4d41c8f-fd76-4d93-94a0-268f98e134ec", "value": "05486b43318507e9b40079ccc015fe25", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e163a259-ddee-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709972854, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709972854, "uuid": "809d08e7-5cf6-40ad-ba30-b5a082413581", "comment": "Malware payload", "value": "9719606fb2d6dd29804ea69a34766d31", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709972854, "uuid": "346a8c0b-4b6b-430e-9fbd-2ea7fcb2e374", "comment": "Malware payload", "value": "935edc6791d944bb0c43dbfe5ef09a42fc6ff15e49eacec7efc404a2109ee4fa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709972854, "uuid": "5bd3a742-e7d0-458a-bb42-99ecfd3ee9fc", "comment": "Malware payload", "value": "66bca593d9846905101c55b64c2eca0e7ca84a99", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709972854, "uuid": "20708e7e-2089-4f73-84ea-c35e3f8b88be", "comment": "Malware payload", "value": "44f4c8803bb1e4031a5d0409f2bec7244591e846141e9077efeffbc98a0601d27026caf61e3b03c4eda02f1842889256", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709972854, "uuid": "fd4af6da-dca6-4da5-a3ec-4a0d7e00812a", "value": "T187F6337881329C8DECD0CEF6CC103D918E197C7AD1111A1F9DA5B1BE88BD9785B978CA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709972854, "uuid": "915b75a6-d127-429a-806c-da211d7a079e", "value": "b1a57b635b23ffd553b3fd1e0960b2bd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709972854, "uuid": "a19e5ba2-ad61-4263-b72c-3da687157f74", "value": "393216:MYRQxHSrPZDFsoinlbMWDi6X0gR0SpT8ad+ukAzOe1T:sSTlFPglbz06Yy+i1T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709972854, "uuid": "793d125a-493d-49fc-adce-73cb01befa0e", "value": 15608184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709972854, "uuid": "419ad773-b20e-4d92-8563-5f56ac1e4adf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709972854, "uuid": "a28e67b1-ba50-46c2-8907-b238cbe77760", "value": "SecuriteInfo.com.Heur.12390.20496", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3b10425-dde5-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709969020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709969020, "uuid": "b9fd7b5d-aa38-43c5-8795-597789b8a629", "comment": "Malware payload", "value": "de2bee41f95fee97763835ee7f8fd9fc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709969020, "uuid": "1fa862e0-c9ee-43bd-a5bf-1481b601a429", "comment": "Malware payload", "value": "947ffbdb5a1d755cfaeb4e19950eacb8374529cb960f74bc7f535ce5e839db56", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709969020, "uuid": "04331e82-f168-46cf-8722-89148853e81b", "comment": "Malware payload", "value": "fd786e00d51ebc78801d7bd7120179fe87ddd86a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709969020, "uuid": "f7c623a3-cc51-4a65-81cc-582ba0f54277", "comment": "Malware payload", "value": "3f0fc60b2ec3e9c82de78bcd4ddcd537193f05df821bd23cb25e0f919ccc39d8235f54e86d00a87c5ebf2876552b288c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709969020, "uuid": "cfc12203-cfc4-450c-ad79-9807406b8d81", "value": "T141A3F842D141982BF57E8AB269EE4B589768AD320F8195B7D3C45D3C34B93E27E3130E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709969020, "uuid": "d271749a-8900-4e48-86b7-8488d9e56823", "value": "64e112904d4dbc7897026ba11877cd59", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709969020, "uuid": "b43c8a06-87b4-4c7b-a5d7-1d09fa7d502d", "value": "1536:LpS65uX/RNQQtfluVQY/80gq71OgskxI9kubZlfbBTHHj8xT6q0Mwj64:LpS+QXMDdUuI91dTE+vMwj64", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709969020, "uuid": "1eb71e2c-99a1-48f8-8e20-5a75c58bbada", "value": 102400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709969020, "uuid": "505b88ed-f464-4780-8853-b3470e7309dc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709969020, "uuid": "8b92a1f8-35ac-42b1-9d75-8026ac0fff6a", "value": "SecuriteInfo.com.BScope.Adware.Presenoker.8654.26610", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af74d98f-ddf6-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709976207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709976207, "uuid": "510c060b-f6c8-4705-bf6b-fc1eb28a632d", "comment": "Malware payload", "value": "e86f2caa0d7c00bf894e23f8e88c0c08", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709976207, "uuid": "aeff2244-5b96-468b-b63d-a60edc2efab1", "comment": "Malware payload", "value": "958ebcc6408dc6219b92673b7dc37ba79d237d5a1da782d8ebfc415a24ba668c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709976207, "uuid": "eb4339bd-3778-4f8f-a909-1aa2a4984136", "comment": "Malware payload", "value": "ad44302f64b9278cfd7815b3f53f49bf87421ea5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709976207, "uuid": "32aab385-f343-4a46-bf01-b018d73c805d", "comment": "Malware payload", "value": "669be8349a823ecbbefc254c0c683f79a1858c1759e4362e7d08fce292fd3d3e9655469906a7e465993738137c2dd1a4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709976207, "uuid": "d45b43ce-bcae-4321-8a23-405dd9df5a4f", "value": "T145A5123A01D8C66AD691303992D8B49728281ECDBFC4D3C9A9B6BC9DEDFDF534125312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709976207, "uuid": "cf6093e5-ee8f-47a3-a202-f556905522ee", "value": "d879a65e465b1c412670e44fbe2d8e6f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709976207, "uuid": "c749b357-dcb9-4223-a07a-5957cea36d5d", "value": "49152:sbrmcFtcE6aCaJmW23BOySN1/HSd3ry2FK8I65k2EmP4b6IRO5Q2cE:s/m0t7UaJmZ3BOygSd3m4I65k2YbN0/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709976207, "uuid": "33403cf0-965d-42c5-855a-a28f63f68454", "value": 2076424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709976207, "uuid": "64df0255-c357-44b0-8e17-0afd94f69413", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709976207, "uuid": "3345b746-aa9a-4c40-ab14-59fdaacb8bd1", "value": "SecuriteInfo.com.Trojan.Siggen22.10132.20379.26841", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "458b76c4-ddd4-11ee-b7ea-42010a9c0006", "comment": "Malware payload (LummaStealer)", "timestamp": 1709961426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709961426, "uuid": "072d4809-290f-4ccc-87c3-e4d92c0700d7", "comment": "Malware payload (LummaStealer)", "value": "6e6bbfbc267fe2b222e752482d4b66e7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709961426, "uuid": "a620dc25-48e4-4cf6-9e07-64fab788c7f0", "comment": "Malware payload (LummaStealer)", "value": "95d8a8203fbdf38a3ce777e205a375867bdb44e76067674ec439afaaeb60d031", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709961426, "uuid": "42d42a41-fb5c-4916-843c-d53719d0518c", "comment": "Malware payload (LummaStealer)", "value": "3ec29b9fd4be1c422233737932618ddcad5a59f9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709961426, "uuid": "3f256846-b98a-4a99-afe6-df19595565a0", "comment": "Malware payload (LummaStealer)", "value": "ca3c23feaa0a6457212c0f48bee65a53190cfefc4d3498dd1a13370f6407e4250862dcc7ab3a64ce81728cc096d16fd0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709961426, "uuid": "debd7a4a-d623-483b-b00a-66c56dd47f47", "value": "T1C744F01176F8CC32D9FB0A7418B19B954E7FBC422674419F9BA0372A2EE13C1497636B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709961426, "uuid": "70eb93a8-2128-454b-a081-0126513a916c", "value": "35c41750c1a74adb13b620b0ac1254bc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709961426, "uuid": "dd5302e3-a18f-4d49-a0a8-e46a8f109269", "value": "6144:0O6eR7e6LkyNGQ6PC/USAZNvSfIjM0wFvy:U4hGg1qNvSf9hM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709961426, "uuid": "ddb44b05-275a-4a6b-949f-fb1eb160f37b", "value": 271872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709961426, "uuid": "bf23a888-c6fc-4967-953f-73c801076324", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709961426, "uuid": "4621b62c-8ef9-4542-b734-0916d2aef6dd", "value": "6e6bbfbc267fe2b222e752482d4b66e7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c512508d-de37-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1710004160, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710004160, "uuid": "b9d7b3d4-6ac2-4d5f-ac5e-959931e08ef5", "comment": "Malware payload (Mirai)", "value": "f918ab2cab775f2bad5b34a9680f6fbf", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710004160, "uuid": "bd8c2e65-39b5-4c1e-89fd-d88302e929f4", "comment": "Malware payload (Mirai)", "value": "975dc9d0f7099d3b1ecf8c46aac2cbf3f8224a7a8da313411b1107e0daaa0d77", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710004160, "uuid": "238bacfc-8c67-4550-b88e-b9fb20e3d97f", "comment": "Malware payload (Mirai)", "value": "8bb3c2adf4f8f7590267ac9ab9b2fb14bdba16e1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710004160, "uuid": "74da7d9c-72b3-4757-a940-014b91f61c00", "comment": "Malware payload (Mirai)", "value": "43a992ffb92ee90762ff20e78580bd4a3bdb20ea1b4e4a12b9605bf07f4495cd9150ab679021ca201e6e85327a295148", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710004160, "uuid": "b6449192-c69f-42a1-9089-3ed91401aef2", "value": "T13C534A21A9B92E17C0E5F57B21F38324B2F5170E24A8CA5E7C360F8EFF2855065576B2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710004160, "uuid": "6b8e380b-9a37-4cf5-a310-e4a3c6450706", "value": "768:Z7fOQALkAoqq9WQCcfrRKyhHwwkI+PwIyO2py6WlxOO+h1UlFwM:pfOQdAPSWQCyRKyhHwwP+PwIl8hw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710004160, "uuid": "aaeb4685-bf48-45da-a4cb-91702e9ffb55", "value": 62476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710004160, "uuid": "a90b960b-eb96-4a6b-b527-5f7b42335c60", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710004160, "uuid": "13a7dfe0-5bf8-4812-aba5-20f7a7423873", "value": "f918ab2cab775f2bad5b34a9680f6fbf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c102abf2-de07-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1709983537, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709983537, "uuid": "356b50e9-78c0-44d4-97f7-76b1417a403d", "comment": "Malware payload (RemcosRAT)", "value": "b767206d76da2c53df676a4f8a98d903", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709983537, "uuid": "fd8bfca3-73c5-4a94-87fd-0f93c3504e0b", "comment": "Malware payload (RemcosRAT)", "value": "993f36b20759d8332adcf16bba3414c333d4f641d70736239f956616096d80b3", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709983537, "uuid": "96cb5a2e-b661-47bb-9add-161820726be7", "comment": "Malware payload (RemcosRAT)", "value": "d65c6fdaedaa406aa0e05a868a227c68037ae724", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709983537, "uuid": "ef7f754a-7d27-43e8-9af2-9ac3f6ab156d", "comment": "Malware payload (RemcosRAT)", "value": "a3f7201789b9f4b171302e5e9a53b50f87a553994e2409268a9bc8fa56123b1e35e82bc4db394d7550ace2ed7aaab2c6", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709983537, "uuid": "18f67184-d2f5-4811-8e77-4abbacbc0fb9", "value": "T1F193272DD34B02698F620377AB571E5441BDBA7EF39452B1306C537933EAC38A1262BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709983537, "uuid": "11a2d998-c794-4e2a-96e1-2cb19b2ecbe6", "value": "768:GwAbZSibMX9gRWjtwAbZSibMX9gRWjtwAbZSibMX9gRWjZcDoZPAGs5UILbM7:GwAlRkwAlRkwAlRicKj/UM7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709983537, "uuid": "eeedf79c-98f7-4ede-8131-5d822dd6c8af", "value": 97429, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709983537, "uuid": "dc250190-a5eb-4859-b187-b033047a7402", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709983537, "uuid": "a66fe35e-a792-4911-b25b-1989f3d1c1a2", "value": "PO881620-2024.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ced45eb-de02-11ee-b7ea-42010a9c0006", "comment": "Malware payload (QuasarRAT)", "timestamp": 1709981329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709981329, "uuid": "2fcb57ac-8ecd-43bf-9950-941a0c612d3b", "comment": "Malware payload (QuasarRAT)", "value": "8338bbdd6ab3ad35c0fbfbebe29813fe", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709981329, "uuid": "c3b8d750-8ded-4886-8bd0-b54d06129922", "comment": "Malware payload (QuasarRAT)", "value": "9bf5171dd1229ee3e488e3fd3d2a067a85e227d0ed54e1ed18bbc35a89f698b7", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709981329, "uuid": "4b4f39d2-d645-4c83-8cbc-6bdada92d857", "comment": "Malware payload (QuasarRAT)", "value": "39f017290209564e34eb7aec80eb2a91a2f5d2d5", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709981329, "uuid": "372b8142-b193-4856-8049-7b724b704de6", "comment": "Malware payload (QuasarRAT)", "value": "0f9cdf459020cf5b6e207bd8ae05f9340a7b9f06b48e98312d46534a1ce53e7ad9b1ab43a92f920d7fcc7aa4c61ef4b1", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709981329, "uuid": "fd2e7af9-edec-4a2a-9b7f-66d5757dc078", "value": "T143B63302E2E90021F5F9A3369FB789D1987339111E72D7FE1E0B512F0A635AC6E72791", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709981329, "uuid": "e9ee848b-885b-426d-8cc1-9000ad6d8247", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709981329, "uuid": "eea75a19-b4a0-4db3-acb1-0a06f98bf2c5", "value": "196608:FvqmYcUiDN2WUFUb7+sK9D2lmLZSJYDHcECkFQT8eqolovLaSC5Mn2jOSrD0lzUC:Fy/tiBZU6b7+hSmEJiF7FQgAovLz2KSt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709981329, "uuid": "8c1e4828-6e19-4c34-9c1f-3a89d7d03dbd", "value": 11367936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709981329, "uuid": "3ae304a3-b111-4a3a-b700-a610ce8e1ec4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709981329, "uuid": "7cd3d8b8-4e61-4116-8b86-566a65a69595", "value": "8338bbdd6ab3ad35c0fbfbebe29813fe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0d30962-de0e-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1709986490, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709986490, "uuid": "6edcfea6-6360-4e25-a79e-6bf2d805ea0d", "comment": "Malware payload (AgentTesla)", "value": "10ccda88421161be7225eae08a53f74d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709986490, "uuid": "8e2b3ffa-5f93-4647-a80b-91cde73d989a", "comment": "Malware payload (AgentTesla)", "value": "9c3621201f107e7bd2aa2071e6186bc1db447c59908e8e3816a57265957ecf95", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709986490, "uuid": "5ef0099a-7612-4110-b564-532607079e0a", "comment": "Malware payload (AgentTesla)", "value": "29dc8266c73d64c9b167234b00cd885a922ec960", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709986490, "uuid": "d4599747-e8d1-4744-bc5e-29d9445dbb57", "comment": "Malware payload (AgentTesla)", "value": "ee25e840bf59e627e0853290c7019a029ea760709307e1dcfa05ac716f090808393c0bff9e2f37a3c8e8d117ef6e78a2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709986490, "uuid": "5de249a3-422f-4653-b4b0-13b626eb0ded", "value": "T17CD422C22BD6CD79C0A933B7D03B8D5028217872CB943B3D529AF91EB461786E84756F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709986490, "uuid": "b96085ed-76ce-4dfd-9774-e6c430341b1c", "value": "fc6683d30d9f25244a50fd5357825e79", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709986490, "uuid": "b4939e70-6785-430e-9040-980af31714ba", "value": "12288:GYV6MorX7qzuC3QHO9FQVHPF51jgcbWpnomP0DFV9Q9EXXbCGGni4:FBXu9HGaVH6pomP0DFXmEXmvi4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709986490, "uuid": "0766f022-3dd4-4414-a2bc-e1e9a5189fce", "value": 614912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709986490, "uuid": "9b24aed8-786c-4da2-b8a7-62bdcd87c88e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709986490, "uuid": "f8d8738d-f572-4c22-aaa0-5cd630e7bc81", "value": "DHL Express - \u0388\u03b3\u03b3\u03c1\u03b1\u03c6\u03b1 \u03b1\u03c0\u03bf\u03c3\u03c4\u03bf\u03bb\u03ae\u03c2 908755466787.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a36c3886-ddfd-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1709979193, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709979193, "uuid": "4c297f2e-d263-43b7-8a0a-04c7495729cb", "comment": "Malware payload (Mirai)", "value": "1821e8aea81908c541da4093676197c2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709979193, "uuid": "cce0a6ca-ea73-4288-a1da-1d22134a7737", "comment": "Malware payload (Mirai)", "value": "9da4c1edaaa92b58f77e932ea13495be80cfa89c178c534ea202d4299a1d0c6c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709979193, "uuid": "c16626a5-b628-4970-bf09-fe389ff427ad", "comment": "Malware payload (Mirai)", "value": "5ec6221a5f84befab6ce7c68210a9c59bc541c4f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709979193, "uuid": "f3f22b27-d1fd-4554-ad0a-9b3ac863377f", "comment": "Malware payload (Mirai)", "value": "f66dfe6510ce5c51a75abfb1bd38705adca1eb5708af8f3b930ff1229ca9ff16c4326da924f1505cb2601784cda9c6d9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709979193, "uuid": "f7bf7a97-c230-44b1-8bd2-22836bed8011", "value": "T181B33B57671C0B43C58B5AF52C7737F187ADEA7102E221C5A50EFF801B72A701A26FA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709979193, "uuid": "9fd9a5a2-4def-4a2e-b3c9-04b31b46842b", "value": "3072:9HXXEk323bEk7NTONRwQr5hDTnhWK2QnI0PDG4gQNcR:93rKIk7NTOYQr5hDTF2QnI0PDG4gQNcR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709979193, "uuid": "1ab83041-797c-439f-9aae-fdee285e4328", "value": 116369, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709979193, "uuid": "bcb95b9f-8e22-4f78-800c-173484a6e5da", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709979193, "uuid": "8f615171-b1ed-4483-87a3-c118518bb0e5", "value": "1821e8aea81908c541da4093676197c2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f17a72c-de0c-11ee-b7ea-42010a9c0006", "comment": "Malware payload (njrat)", "timestamp": 1709985467, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709985467, "uuid": "8cd3083b-f113-444b-9f58-ecc1b7780b28", "comment": "Malware payload (njrat)", "value": "7a42a998ec1c225b4902db1beef5f917", "object_relation": "md5", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709985467, "uuid": "2775d862-1e53-4e28-91cf-a6f027036400", "comment": "Malware payload (njrat)", "value": "9e1f6b7d00d04ec374b6b1811c5a809b51c298a7b01efd3cd697bf20ba6428a3", "object_relation": "sha256", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709985467, "uuid": "149d75a0-3c12-44ce-8e59-fdca126b0cf2", "comment": "Malware payload (njrat)", "value": "d47ec0ddcf45295fecac0e003e03dfe09245b7bb", "object_relation": "sha1", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709985467, "uuid": "11d66a37-032a-48cf-8143-6d2956ebba85", "comment": "Malware payload (njrat)", "value": "ee2493123aa5766cfbd47fc40a8de325eca6de21361bc7028c5b7297554bfcbe0fbee0f636ae9e0eabc1a67892f38e90", "object_relation": "sha3-384", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709985467, "uuid": "628c945b-1617-481c-8f7a-4a4eb7827dce", "value": "T151E19D6FC884D31CD37302BE13A99CEAAE6990B15511DC6E307471E84BA2D5A731F16C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709985467, "uuid": "456a78f3-5bfd-4d38-8213-5c2ac0b866ee", "value": "192:xrXP/cQZ9ppmGA6Hpyk3nl7x++ODCs2O6I:dXPp9ppvA6HJ/++EbXv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709985467, "uuid": "ad11ec65-4942-4757-8f36-c4e9362db6f2", "value": 7352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709985467, "uuid": "ddb04e07-170c-4c2b-91d6-2340c815e231", "value": "application/vnd.openxmlformats-officedocument.presentationml.presentation", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709985467, "uuid": "a983dbc9-001c-4337-badc-66bfa07bee34", "value": "Reserva Detalhes.ppam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c6dd2f2-de06-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Vidar)", "timestamp": 1709982966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709982966, "uuid": "9da4fe99-da4b-4bea-90c0-b839d31340af", "comment": "Malware payload (Vidar)", "value": "b811375681040dc06e21d081388aca70", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709982966, "uuid": "8fc98ed4-6fbe-4b73-b8f0-b7989b146e76", "comment": "Malware payload (Vidar)", "value": "9f9b8278f297ef3b9e449dad7c7cdbb171167ea5831bc2f035054ff7ca5b5570", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709982966, "uuid": "4cf4c981-aa70-45ff-a62d-4767517cd316", "comment": "Malware payload (Vidar)", "value": "733ef9c5b36d1020b878addcf8adda1455a503c0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709982966, "uuid": "5851fc8d-0c71-4ed7-8f0d-cabe345276cb", "comment": "Malware payload (Vidar)", "value": "b126ee1f4c0eb3aa85bb7f1fd2b4ec9ea2d0b55a757f5e6a496cefc3ebbc9daaf85a4f92ebf9e564b5005899f8bb02a2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709982966, "uuid": "b8fdaf5b-79f4-4915-b6cd-2ded80ed9eb7", "value": "T1F96623696ACB40E5D8420470D71BEAEB33F311FB49C54CE5E9CB3174B062F626D6BA06", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709982966, "uuid": "92a6d067-ec3a-494a-b284-5c65c4672a49", "value": "53d074b20d6fe6af6e28d663ea0bec78", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709982966, "uuid": "9d77be75-956d-42a4-a242-4027561b38b4", "value": "98304:P47LjEPOV0b7YzQMODS+GtunBJl/YY9AUipFGnTbSmCNPfTF3CSpouj/W:PwLMOV0bdMNhtiHYhn7KTG9Bb3/W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709982966, "uuid": "e131a54a-944c-49c8-9f26-f23c9456ecc4", "value": 6737368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709982966, "uuid": "9dce17ed-6bf4-497c-9100-3c6b6faa82a3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709982966, "uuid": "e28c880e-d490-4e02-9ac0-a374e3bf0403", "value": "b811375681040dc06e21d081388aca70.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83f933db-ddff-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RedLineStealer)", "timestamp": 1709979999, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709979999, "uuid": "d777415b-353e-4099-9193-648fba4def6a", "comment": "Malware payload (RedLineStealer)", "value": "9d047bc396a89a88a5780ca14339a2c5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709979999, "uuid": "5bd0d871-05c7-401c-b994-08b2652a6a17", "comment": "Malware payload (RedLineStealer)", "value": "a060707aabfc54746aed0034105eddcf4f007d05e5f3fdcb3e03360daa7d8fed", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709979999, "uuid": "91d80f71-0ce8-4d1e-9318-64241a993e4e", "comment": "Malware payload (RedLineStealer)", "value": "0f47baa43901fdf2d5c8f13c5347adb0228087bf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709979999, "uuid": "83e0c15a-4f44-41fc-8eb2-97576cad1f46", "comment": "Malware payload (RedLineStealer)", "value": "a84d5010379f356ca6cbd5d851cdece3b16c878c046effeadc7cc4292b81e8de315defa380276484409f0ba5c0d385f4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709979999, "uuid": "26543e70-4be6-47a0-8f61-8b97eaaa253f", "value": "T166763B57F55AD900C1955A33C2EA2914E36397C2531BF31F3292BB6E5E433BF468E08A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709979999, "uuid": "34f40f5b-2890-4aa4-86fc-fb39e1afbc95", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709979999, "uuid": "82bbcc32-6cbf-4939-96ce-2627d6954168", "value": "49152:FwSQgIz/TTBGaoojM9TY/4St16sAS8gCf56v/IgRWbMWMH6VlBf5a6uFKp3O+MSd:Fwn1tWbQHelfuFuN08qecq71", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709979999, "uuid": "d7083640-7015-4d3f-9901-9a7dc3142ab2", "value": 7353680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709979999, "uuid": "a54ddbbb-d579-4c61-a7d6-187c0b17c797", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709979999, "uuid": "ea5c5950-3c0d-4cdc-bb4a-d6286a3f4a74", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f12aaab1-de37-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1710004234, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710004234, "uuid": "9b9bfd12-125e-42ee-bce1-daf40d966b71", "comment": "Malware payload (Mirai)", "value": "18d7b36c2459324eec5c195d049406b5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710004234, "uuid": "7db19691-806f-408c-9686-1f499eca4da3", "comment": "Malware payload (Mirai)", "value": "a1cb5971a7849373ac3766ecb697e943fdcaf8ac2eedb2033db63eb6d472e689", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710004234, "uuid": "cdcf67fa-23d1-4a80-b5cb-b282bd6dd8b6", "comment": "Malware payload (Mirai)", "value": "1e44f99de8fb50dff94013d85af7888528f0ad16", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710004234, "uuid": "c07c9fed-4426-4c82-a3b1-ae4dadfd8036", "comment": "Malware payload (Mirai)", "value": "7d77c500e466c2471798f3ce93c84618a0e8a3b188ce94796385b6c3e91cd5d8ce2bc482a456b590e4ebc93787760796", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710004234, "uuid": "376e4f28-0e0f-4179-857d-699de14672b3", "value": "T19763F756B8918B11C5D513BABE2E118D331753B8D2DFB213DE106F60778A92F0E7B862", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710004234, "uuid": "b905e2df-edc8-48d7-bf6e-4d6b26a6b10d", "value": "1536:2ZngEj8f2BJoAQAnZmss5txFNNEczKKv2VfA6qRYjrmW4WLhI5i7v0GZW5/:zEjDuAZmVFF0czK7VY66YHXv0GZW5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710004234, "uuid": "eb654325-0598-4409-b691-f6143ef61d43", "value": 70908, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710004234, "uuid": "7aa713c2-d152-49ac-a97f-23752d604258", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710004234, "uuid": "6bdfa74c-12ba-4907-9c6f-6dd04dafd926", "value": "18d7b36c2459324eec5c195d049406b5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e90b425-de66-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1710024282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710024282, "uuid": "d21de182-d3ae-4add-af07-cf632cf49c0a", "comment": "Malware payload (RemcosRAT)", "value": "a23cf24af6aa3326da7b9137254fce9f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710024282, "uuid": "0c23543c-6f3c-46fb-b813-7426106f80bb", "comment": "Malware payload (RemcosRAT)", "value": "a2286f2cc8d3bd4c2cf7d80588106f40a9f43173b1f7f96187660dc7fe9bef61", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710024282, "uuid": "c22d1a43-504d-40ed-91e6-f502bdc2b2ab", "comment": "Malware payload (RemcosRAT)", "value": "5155a136481b777d186e6e8e1baa9de4ca67f25f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710024282, "uuid": "97a4aeaa-2929-45ad-86b5-d714fe7622ce", "comment": "Malware payload (RemcosRAT)", "value": "98294eebd12fcfa89e859638324105386aa18d7bcf2b81e1c1e37a7182616be11f6f22100b7f9fa47bc270fc6c4db9c2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710024282, "uuid": "254d7edc-f839-4e39-b467-32e5c6c58afb", "value": "T100250241B3E85B29E6BA8BF9142051100BB2716F75E5E31C4ECA74CE2CB1F114EDAB67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710024282, "uuid": "6ac134b6-90ba-490d-8620-5339075a4009", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710024282, "uuid": "08e04aad-aa5a-4024-9d34-23ac4e40003f", "value": "12288:9BtgAg/jQiLE7mBJDmuH5V43H8UJWLaBn8JF3kurnBG1Oo2HznKtD1o8PJ4:Kf/j+8xV4cWOJF3kuzBoT2HDKtD1ot", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710024282, "uuid": "be5ec4a5-20ba-4c4d-84f2-efd82fd4c4ed", "value": 988160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710024282, "uuid": "bf573af8-8745-4ef8-80ad-2d22fc23dfe2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710024282, "uuid": "252a4ac6-9500-4d45-918f-e37fb53e8e48", "value": "A23CF24AF6AA3326DA7B9137254FCE9F.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aeb80fa2-ddf6-11ee-b7ea-42010a9c0006", "comment": "Malware payload (TrapStealer)", "timestamp": 1709976205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709976205, "uuid": "16dfa02c-dae9-42af-a634-9bc650cf4271", "comment": "Malware payload (TrapStealer)", "value": "ed227fafb9502bfe228f45e9fc80fb5d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrapStealer", "colour": "#1C75BE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709976205, "uuid": "842df29f-d784-49b5-87b0-84e1c63c20a6", "comment": "Malware payload (TrapStealer)", "value": "a24c89c14ef0d6701e0b7b671fb879a2e488a1d0a6c4488b282f9769ea18e0ee", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrapStealer", "colour": "#1C75BE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709976205, "uuid": "9525b4d9-22cd-4c5d-b3c8-3dd832e76d8c", "comment": "Malware payload (TrapStealer)", "value": "79500abca660e1551cb49c714f1661bce01a7243", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrapStealer", "colour": "#1C75BE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709976205, "uuid": "99bdcca3-0d35-41f8-9098-bc617ad9a12d", "comment": "Malware payload (TrapStealer)", "value": "e4c792bd6e1cb4125ffaa3d092fc83a34135029f292e09db206c251fa7496a7a72bc944e9d4f89124cd14109f7a3969e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrapStealer", "colour": "#1C75BE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709976205, "uuid": "1e31d42f-b6c6-4c0f-bc3e-a6d8283d0fe8", "value": "T171D63384A2541CB1E3F6C23D9689C83AD332F8B11360D6B713B4D2972FB72974E39596", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709976205, "uuid": "21d2ff14-6683-4647-9cae-87775da35aa2", "value": "bae3d3e8262d7ce7e9ee69cc1b630d3a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709976205, "uuid": "0821b9e3-8e6b-45a9-a86d-d276132a7f66", "value": "393216:FDjnxpUTLfhJsW+eGQRCMTozGxu8C0ibfY6eKkuzP:FDb7UTLJSW+e5RLoztZ0R6eKkyP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709976205, "uuid": "7ebef84f-427d-4f22-9958-73e35d762ebf", "value": 13616782, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709976205, "uuid": "ff35f7f4-3f1f-453f-8e1f-e88974702674", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709976205, "uuid": "8fffd42d-b1b6-45ea-abeb-884fe5b49734", "value": "SecuriteInfo.com.FileRepMalware.1994.17999", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcfa05a3-de37-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1710004254, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710004254, "uuid": "94db5c63-cf7a-4db2-816d-a95895210496", "comment": "Malware payload (Mirai)", "value": "5635ddaacfb4a4472009dce233f75e07", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710004254, "uuid": "5cd01518-6e93-4811-a0d3-bc578cefeca9", "comment": "Malware payload (Mirai)", "value": "a3ca71d9899bb7f946f7088f9dc63a2cab00f82e7ed491da5eccd73608fdfb8a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710004254, "uuid": "28497818-ee53-4006-ba84-43bc45ea6ccd", "comment": "Malware payload (Mirai)", "value": "916707df3a2d5d2ef96d01a1d5f3eac5fa27c5d8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710004254, "uuid": "3ab965f1-7e2c-4dea-abbb-1f49e488061c", "comment": "Malware payload (Mirai)", "value": "c8120811b5eb96c32df02e8ae47e7bfc227df634452518b9c82f9524da88423847b65a869aa042402399e4287848f689", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710004254, "uuid": "4e68ddce-7204-4a8f-b582-99d9c107b4d8", "value": "T1E7832996B8C18B11C6D512BAFA1E118D3313177CE3DE72229D206F2477CB86B0E77952", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710004254, "uuid": "863e0bc0-cb91-4346-b407-e91e8f9f400d", "value": "1536:A0nmnWY5FiTMCqUsDSl1YwHIU6anyH4buQ/MViTDI3eWI7gp5uSibc:10Fot3VIU6annDI3eWI8pY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710004254, "uuid": "320efc7c-0ae9-4d15-8f36-b41da0b28528", "value": 83448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710004254, "uuid": "22d6ed62-66a7-46c5-a078-ba3b093538c6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710004254, "uuid": "a9bfdf01-948f-4c6f-a073-becd881ae44f", "value": "5635ddaacfb4a4472009dce233f75e07", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "694bfa1e-de2f-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1710000570, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710000570, "uuid": "93d606f4-d4d5-4c8a-b926-77d495a93c97", "comment": "Malware payload (Mirai)", "value": "43cd52e838924a8d21676cd3c65614cf", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710000570, "uuid": "3a280d2d-d824-4fba-8381-c52976ae3304", "comment": "Malware payload (Mirai)", "value": "a489b705da011db0946b4252a322b515f63edc74e704004d14a9e55069db83f5", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710000570, "uuid": "ec37d6bd-cee4-4a7e-ac09-73883009c033", "comment": "Malware payload (Mirai)", "value": "4b39ac57c5473f59914a1fd4fd39c6685d531d2a", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710000570, "uuid": "b6627a93-d619-4372-8ab9-52def1942cbf", "comment": "Malware payload (Mirai)", "value": "bdfe9ba60fb1573ca8d3d678eef67f7a8188bc5d4b376c75a91559fed3fe8e55a02c230279c509da801811ccc32dd092", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710000570, "uuid": "345b6b55-7804-438c-88d6-22fcbea2e343", "value": "T18004FA1AAB510FBBDCAFDD3706E90B1139CCA54722A93B363678D524F50B50B49E3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710000570, "uuid": "61555bef-e2f3-464e-817b-5558703c9831", "value": "3072:uCQDElnTkhX5MZ6vKOgwRl6adAbVNjtK/iy8:uCQQRYhaZ6vFg+ljmLZK/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710000570, "uuid": "586fbe49-4d98-4a5b-ae73-de1398b056bf", "value": 177856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710000570, "uuid": "91de2fe9-1b1f-492c-a40b-17c25ea3041e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710000570, "uuid": "43a1140a-8612-4026-99d1-89d9f4c43e72", "value": "vlxx.mpsl-20240309-1609", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3dc6fc9-ddfc-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1709978818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709978818, "uuid": "b97100ce-fa95-4ea0-a189-20a3b9cad1ea", "comment": "Malware payload (Mirai)", "value": "4f0ee6de5ba0a0ec81d70c68b9710b3a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709978818, "uuid": "1319d6b2-0465-40c9-a3de-4c6da1b7fac4", "comment": "Malware payload (Mirai)", "value": "a4975a9715693bcb327a0267e26744c4016748fab310d605035fa43095870b20", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709978818, "uuid": "11351101-395f-4881-81ae-466f341cb943", "comment": "Malware payload (Mirai)", "value": "33272926c2f72b4075b60875ac3940bd7062274c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709978818, "uuid": "cdf35b0e-1e39-49e8-8e0d-bd3407e8754c", "comment": "Malware payload (Mirai)", "value": "4bdb978d60e66a48006920ad3f425c0927ee2a2c08cf1d0cde12245601d9acd28af60e62ed19c6a96b20c9fd21af2fbd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709978818, "uuid": "2a3d66f6-50c1-445f-8b4c-b398d457ad84", "value": "T1D6338D36C87F6DA8C5448638B8214A342F63F504C6A7AEFA9B8187655047FFCF6183E5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709978818, "uuid": "28ecab9e-04fa-4ea3-be83-f21812bdae50", "value": "1536:0aIB1nkW5wt1l4ZhTZJNexd+3+4keEtCQqd42+:0XXnkW5QEreO+4ke0k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709978818, "uuid": "384302dc-d9a6-43d9-beda-50ae3f6e963c", "value": 55116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709978818, "uuid": "4bf294d2-63b3-4727-a9ee-9c69bce28be8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709978818, "uuid": "5814e040-d840-4210-adbf-404aef9cda6a", "value": "4f0ee6de5ba0a0ec81d70c68b9710b3a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79391a4f-ddf5-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1709975686, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709975686, "uuid": "14766eac-0530-4db1-9020-731c23ff6b96", "comment": "Malware payload (AgentTesla)", "value": "5072b45f4e46fd71a4ee787194b996cb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709975686, "uuid": "dcea7027-416d-4197-8746-2983c53c9ba3", "comment": "Malware payload (AgentTesla)", "value": "a4ec5a5df2d564dd592f7d5f94de5c752b0bed56cdffed8af2719ff63c7db332", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709975686, "uuid": "db96b0f3-a17b-42b5-ab51-0c01d378593a", "comment": "Malware payload (AgentTesla)", "value": "5b01b97f4f87e9e6556e6cd3960671dfa3cf4509", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709975686, "uuid": "ec3ee04a-54b1-45ad-8a98-70d4301d6fce", "comment": "Malware payload (AgentTesla)", "value": "06983fab7c7a179b65043f95caf571a9961c8b69d270ed6f4b8bc0d26908ad5bb77a78f5e2c028fc5dfb7dfaab839de3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709975686, "uuid": "4464ab3d-9f5f-48b0-b42a-3a8758d6bcba", "value": "T17D0502C033AC1B46D6BD83F21672888077B6B9272465D70DACD561CE0E71FD0A62BB97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709975686, "uuid": "c8ca832b-f3a1-4b31-8a5b-03c690cd74ef", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709975686, "uuid": "aee6e029-b564-4707-a25e-a60aadeb4d32", "value": "12288:8NVP2iNAOl4+LOcMOgb3ZJb9lAtOgGvo5qVb4gvY42O6v27cCaW/PbkR:8NR13ecMfXx4ee/UYril/P+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709975686, "uuid": "7c697c30-1555-49fd-940c-4d57a38e29b8", "value": 796168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709975686, "uuid": "31fd25dd-010f-4844-bc84-ea473a41f8f7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709975686, "uuid": "beb6228e-f046-4475-90e0-2165c1a4eb62", "value": "5072b45f4e46fd71a4ee787194b996cb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b378869f-ddfc-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1709978790, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709978790, "uuid": "0a01a5a7-8334-4b11-971d-8d532b1d1a58", "comment": "Malware payload (Mirai)", "value": "5141f3cde5b02494cb9facb275583ba0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709978790, "uuid": "cd28e895-405b-4e97-8df2-70b7fd408b07", "comment": "Malware payload (Mirai)", "value": "a506d7ca9270acec8622ddd4bacd53768efdad87c4203c80c1a955860fb930c7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709978790, "uuid": "d5c4abb1-a805-4744-9d65-25b2bbafe53f", "comment": "Malware payload (Mirai)", "value": "1b693d652d52003700ea18cdccf8895d57133e45", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709978790, "uuid": "1ac89bfe-f4b4-475c-9410-c115eca46f2b", "comment": "Malware payload (Mirai)", "value": "409c2c9fa6cf48bfadb4fac64cc14cd471f7077ab422133ffe686b24e3eed8834f9a8a77b6fbe77a7df8aadf109071d3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709978790, "uuid": "e27d9a52-4111-4039-89ae-7e7957ec1f0b", "value": "T14173A70A2E25CF6CFB5D827587F78E209658339A26E1C145E15CFE021E7074E741FBAA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709978790, "uuid": "e418ff6f-1e71-4b00-97ea-59cc0fc31760", "value": "1536:q+XjfupiLLwEuTjpUcnD4FZ0vEyvNq26/UKFu5L/2Nd42+pH:q+LupnEmCOD4F+vEOq26/UKFute/yH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709978790, "uuid": "8569450a-42b4-4294-af9e-7bdf83c33143", "value": 79988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709978790, "uuid": "b360f87d-6c26-45d5-98ea-5a276c02c823", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709978790, "uuid": "208e69e5-6c88-4a07-8771-287c927c4800", "value": "5141f3cde5b02494cb9facb275583ba0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8085cf30-de11-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709987724, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709987724, "uuid": "01133413-8feb-4f6b-9fcf-9925e5c8bb8c", "comment": "Malware payload", "value": "543b1875b88ee2c7e10c36f52bc445c1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709987724, "uuid": "ecf7b0d3-c8a6-4d2e-9bb3-47f2ee9b8f22", "comment": "Malware payload", "value": "a6c2c7229fcebdbf294e16531635fb8bb9b1c0f26b498da21b420b8537c804f7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709987724, "uuid": "b7b4099c-e195-4f8e-a74c-f6cbe1856ce9", "comment": "Malware payload", "value": "c95e9463707fa62ad6830adbe16a7c2c562961cb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709987724, "uuid": "c57ce5ab-6f83-410c-8741-dc0862ed27b7", "comment": "Malware payload", "value": "8251720ec9b80c39ab2c3cd356799dd3166c54785516a2a3ede275a81048a3a06ba440dd1be6a20b9ccba3f70a79eeb6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709987724, "uuid": "5c264fa2-e187-4f6e-8511-c6333b089af3", "value": "T11BD2F1B4B2F43CBCF28805F4A2D6435A4BE4466E34A7B465F9B751D1B012AB6232C08E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709987724, "uuid": "74de4caa-e191-495b-ab85-6a0c5e641553", "value": "768:8DPzqSFpKCj7adky5RrDCo+Ck1LWRrLfV/wcvBw:sPzqSFFty5RyPcRLfVLG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709987724, "uuid": "f73ff7de-830e-4f54-88e9-99650d0674fe", "value": 29450, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709987724, "uuid": "d1b8259a-43a2-400e-98df-c879993d72d4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709987724, "uuid": "032d15ad-1ff8-4e2c-a186-4e9560567d5a", "value": "SecuriteInfo.com.Linux.Siggen.9999.7662.6542", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ded1b352-ddf6-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1709976286, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709976286, "uuid": "91d4d776-57b0-497f-b1d9-0de6d0803a1a", "comment": "Malware payload (Mirai)", "value": "a5b819b3b1f3c6b2c7de138aef24a9fe", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709976286, "uuid": "a6f6b8f4-a7ca-4a42-a01b-8f08022ba6b3", "comment": "Malware payload (Mirai)", "value": "a77d6187bc84344e39ac6c8052682a3e56b8a247860cccce6676e823c499d2ba", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709976286, "uuid": "9ee5c334-d31e-4729-b3da-11ae87915e66", "comment": "Malware payload (Mirai)", "value": "c0d857069dc452f3c7154f79606f9bf160083968", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709976286, "uuid": "a0bc6033-40d3-4d72-a3b5-55e45918af67", "comment": "Malware payload (Mirai)", "value": "8917530a9a7046a6f9b6eef71746f099b5e2fe0a2dee39ed0ce282ceb1013ebc32a01d92019f01b8606e43e9ffc9d15f", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709976286, "uuid": "1ce1a4ca-ba47-49f7-8609-083c2883e165", "value": "T143C31A45F8515B13C6C612BBFB5E428D3B2A17A8D3EE72039D216F21378B95B0E37642", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709976286, "uuid": "9ad42258-0cc3-44bb-8cf4-264a65210789", "value": "1536:Jh7JW6nG5k8wfaaFAaFY1LAthi4VvtnTV+HfIo+JSjpChrDObl/Cwyw8FAUk46CU:n7JHg4FZC1Lh4XnR+HfIhMpCho3jr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709976286, "uuid": "e6dd53b2-729f-4272-845d-23503ea7a303", "value": 129792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709976286, "uuid": "022d419d-9600-4d3b-a6ec-d538c784ec55", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709976286, "uuid": "f3331b3c-8268-424f-b407-37314cdefe51", "value": "vlxx.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f293305c-dde0-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1709966870, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709966870, "uuid": "73e958fe-7640-4666-8ff6-75768eff5953", "comment": "Malware payload (AgentTesla)", "value": "573ac709bae3d9e95d795220a778d3a2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709966870, "uuid": "858d4947-bd67-4a67-bef2-bab312ff605a", "comment": "Malware payload (AgentTesla)", "value": "a8773dcb9829d8a6e41bba1de6f8ce14a008fd811336657f5489b65b8af15acc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709966870, "uuid": "e00d21a5-cdb9-4007-a508-a6ca9f24a1cf", "comment": "Malware payload (AgentTesla)", "value": "ac86ce7cf41dfeb9a993e556c60a6b811295f202", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709966870, "uuid": "86d24467-2899-41f8-9f87-12a3c5183a45", "comment": "Malware payload (AgentTesla)", "value": "74c597f03751c34e316fb5ca0972cff753c14ff595338a7022443cdf1ef080caaa1555671c8b7f354e602fcaf41396e2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709966870, "uuid": "3867a340-0da6-476e-bfa0-6feaf67853f5", "value": "T11794BD7265F6AAD2F5E98DB72C118244BEEB2C44CC16948EE41870F512B7BC8C2495FF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709966870, "uuid": "915154cf-9a68-4e28-b4bd-a54d06372a31", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709966870, "uuid": "b0f528c8-264a-4f8b-8337-a240b18eb7f7", "value": "6144:sjJeKScBVOCB6+3wLYVscDymE/7HmAUZFkHkYTrpxu+bUzIcg+geP2ZK5UXt2QU:sjJeKbBg+sVmEZCoBxPPVfo5y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709966870, "uuid": "d4d27a29-d2ce-4481-8993-fed4d141bcc2", "value": 413696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709966870, "uuid": "69ad054f-1bfc-4c27-8624-00194cb914c5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709966870, "uuid": "ceeac949-8e9c-485e-931e-ed162d9f1c0b", "value": "573ac709bae3d9e95d795220a778d3a2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c2151d6-ddfc-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1709978751, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709978751, "uuid": "eaf8961b-605c-4cc2-8b4e-9da88326377f", "comment": "Malware payload (Mirai)", "value": "e933f97a4a987c23994960ce9210eaa4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709978751, "uuid": "cba3a579-46d9-48c2-83a0-db69a39e2223", "comment": "Malware payload (Mirai)", "value": "a87c9f3fb0c2eb490707407ee1c356d4ac93cb31903712c1b684d0d6cb58ec6f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709978751, "uuid": "e683150c-8d5d-4952-903e-866eaedf5475", "comment": "Malware payload (Mirai)", "value": "324014b5ab08cc2497a836194f7f8d756d5167e5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709978751, "uuid": "d2cf6d80-1be7-4054-9df8-adc4a7459fed", "comment": "Malware payload (Mirai)", "value": "10b0b5ac2905ae51c0c53f6b25be44372c1dbfb14129779847bd989c123875a32ae72765a8e15a9bc78dd194ed58c027", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709978751, "uuid": "ebd1d4f0-beff-4466-b120-5179e752cf7c", "value": "T17CE319D7F800DEFAF80AE33748530806B530B7E245925A372257797BED3A1991867E87", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709978751, "uuid": "54f8f3ea-2d72-4b5c-9d59-f50960c1c11b", "value": "3072:KVIrDcrhb7+zbSiH1nA4UkZijVrjbiJLXRGSoyaiF5i:8Ir/fHVA0Zi4LXRIyak5i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709978751, "uuid": "6befa23f-9c1f-47cd-af31-d5caea2857ff", "value": 150464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709978751, "uuid": "e7955541-fdf4-4a31-8f3b-af40972e1931", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709978751, "uuid": "e7493c92-5f8f-4b28-b8c4-17234b1fec94", "value": "e933f97a4a987c23994960ce9210eaa4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35822593-ddf6-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1709976002, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709976002, "uuid": "69741d5d-fbe6-46b7-936e-19af75c3a1a6", "comment": "Malware payload (Mirai)", "value": "35a190f5655429ca4536a9af76472da6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709976002, "uuid": "436e4de9-62a5-46f4-8ba3-d9bd352ea340", "comment": "Malware payload (Mirai)", "value": "a87d4d827550c5a1ba03094c4afb8ff7c78febce5ef2fb3795800a7f6ebae277", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709976002, "uuid": "a092d967-9626-4de6-a1ad-f65dfa8fa525", "comment": "Malware payload (Mirai)", "value": "893fdf8c5f5cab272b5d402bc7581603dc17998f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709976002, "uuid": "6f8540ff-82a1-4881-93c8-7ccb2661742a", "comment": "Malware payload (Mirai)", "value": "bfaed5901fa5a424d12a691991cb7a36d7039199868293f0850030db39b69d43400e98b8ff380467f3d22925b5e52791", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709976002, "uuid": "5e7f3a6a-6b29-4e35-817a-6ad6539c6f67", "value": "T174045B56FB408F13C4922775BA9B430533339B9593E76306AA28AFF43F837994E23945", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709976002, "uuid": "692859bb-111c-4e4a-be32-3fdbd73e25b9", "value": "3072:KtdN2WhUagM9fhxWqdGHVG8AUTc2mUlilsUxV4VMrmz5wYbSL:KtdMUUagM9fHWveUTc0lilsUxVIwmz50", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709976002, "uuid": "dc647f35-6f29-4001-a2c1-ae8321a48961", "value": 178538, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709976002, "uuid": "16a4fca7-a67d-4174-8d8c-465db7014a84", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709976002, "uuid": "291e9b6c-892f-4eb0-9150-1d3cc4d7a07d", "value": "35a190f5655429ca4536a9af76472da6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2ce5ee9-ddf1-11ee-b7ea-42010a9c0006", "comment": "Malware payload (GuLoader)", "timestamp": 1709974092, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709974092, "uuid": "4c0040de-6bac-420b-86b3-d282dd9e2320", "comment": "Malware payload (GuLoader)", "value": "8a7cbf160cb0986173d6289cefd07d5d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709974092, "uuid": "dc967803-03b2-4dc7-aaeb-54adaeb37c06", "comment": "Malware payload (GuLoader)", "value": "a9b2c138caea017d5255cd4c2c24d56e07179052d86feaa75e59722c714a8e55", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709974092, "uuid": "55213d31-4f54-40e6-ba33-81bbbd7767a2", "comment": "Malware payload (GuLoader)", "value": "69b820cabd7b40163e1921fc404e3f78a41a8b2d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709974092, "uuid": "9da8c28c-8f77-4eed-9289-f5d132c8e5b1", "comment": "Malware payload (GuLoader)", "value": "4f7c3e8d09e87f72d41cf70a530d1c5f276cca8db11c56352bea5f7abec0686018d05ae2f326d91611476cff1c6cdc10", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709974092, "uuid": "cc71eb7d-1fd3-453f-a283-345ab07e2635", "value": "T12BD4F24EB5425495EF61413785A7AE75AF1F7E3875C2833623B43BB85832284CF3E21A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709974092, "uuid": "460a9ee4-2c7b-4448-9642-cb6728531a42", "value": "e2a592076b17ef8bfb48b7e03965a3fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709974092, "uuid": "3152437e-d016-4609-90be-28419c2a117e", "value": "12288:e4mjiqrwQs5dIxdjw8v7yvXQV5UhQmHOkXn9ELRVOwccoSFWMc/fT:WTfs5uHzjYXjamHOKn6LRVOKo6WMcHT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709974092, "uuid": "653e6269-78cb-4f7c-83bd-adf68f8e07b2", "value": 609920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709974092, "uuid": "0fed4145-a9a4-42af-af64-413788322f8a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709974092, "uuid": "1ded49a0-7f63-47be-9b71-97bab9489929", "value": "Medarbejderstabens189.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2c3df20-de07-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1709983540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709983540, "uuid": "902672c2-98f3-4b32-9980-97057e938c1a", "comment": "Malware payload (AgentTesla)", "value": "db2424da91067723c22e76698958d7e7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709983540, "uuid": "4ee23f84-92fc-4ff1-83c5-6fb89938b35e", "comment": "Malware payload (AgentTesla)", "value": "a9c38bfb583207e1f239d6b0d5ebd88c0e513de0b3191a3384278919c4335d29", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709983540, "uuid": "bce7520d-ae0c-4655-8505-8258ea6910a1", "comment": "Malware payload (AgentTesla)", "value": "2b3d5980e287b1e987e88affd62de07adba21327", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709983540, "uuid": "16924e00-8391-4f52-be9a-27f8fd448ac5", "comment": "Malware payload (AgentTesla)", "value": "9142738bbc3dfdc5b09fb3b593420f3a74283095f7809411fb06f7f007c6cac8ee66b01ccaa4f313f257aec903835dce", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709983540, "uuid": "3df84210-0009-45db-808f-736daab0e8cc", "value": "T12AC3E26DD34B02698F620376AB171E5442BDBA7EF38452B1306C533933EAD3DA1252BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709983540, "uuid": "2f50bf42-a7cb-4051-a82c-85b86e14cc8f", "value": "768:/wAbZSibMX9gRWjtwAbZSibMX9gRWjtwAbZSibMX9gRWjcmbffWoQoDRfIxeGeSH:/wAlRkwAlRkwAlRFmbfeoQoDJIee5t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709983540, "uuid": "156a1152-987d-4012-b977-35fba23bcead", "value": 119635, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709983540, "uuid": "026a75bc-f6e2-4626-bc18-64aa30f0efe6", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709983540, "uuid": "42d65928-39d7-458a-9f9d-e2b69018631f", "value": "quote.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b40b9bd3-de0e-11ee-b7ea-42010a9c0006", "comment": "Malware payload (DBatLoader)", "timestamp": 1709986522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709986522, "uuid": "dec43413-47e2-4f38-b585-42c1ac980cb2", "comment": "Malware payload (DBatLoader)", "value": "8d0cb6d4679980927e0cdc04866333ee", "object_relation": "md5", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709986522, "uuid": "cd99e0a1-adcc-40f2-96bb-1df80072021e", "comment": "Malware payload (DBatLoader)", "value": "aa3f8d2a1c918a41c80152464b07574cd8b9e6abacba46bc53183d5434ee16f3", "object_relation": "sha256", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709986522, "uuid": "52660945-11dc-45c1-9630-1e4be3e1bc0d", "comment": "Malware payload (DBatLoader)", "value": "3f076779f5ab69444a189463a20e84afadfe9892", "object_relation": "sha1", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709986522, "uuid": "1df8da34-e7d3-4550-8fea-330d991882f5", "comment": "Malware payload (DBatLoader)", "value": "c6399f0599bc15ee1c32a35d9aa736c75bdc0b06d5dd34692c14b0e95907e84172964707889515d401a0f6847bafb4f1", "object_relation": "sha3-384", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709986522, "uuid": "25f8f7f9-3eee-42c9-867a-99b4c641bf26", "value": "T1F0258D23AAACBC33CD9601385E75F6F45C29BBF62E685CD63BE039184A393813875157", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709986522, "uuid": "15fc3d1a-f9b4-4a0b-8cb1-ef4b9490ea2c", "value": "ede4a721a0b9bbea83535c909d0f6b2a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709986522, "uuid": "41d420eb-1823-4c70-a126-257ee562ff1a", "value": "12288:AfSx+FaMjOnJBReneIPcVCXGmBOVVrd4yABuAMQsWIUN2FELSvVeCs9axIehnhnK:CkPMjOn/ieI37BOXZ5oiG2F02sInhhn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709986522, "uuid": "ac69656e-1cce-47a3-ad36-2539eceaede7", "value": 981504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709986522, "uuid": "d097ff7c-03e3-4a9f-abcf-5f1ddbc4bdf1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709986522, "uuid": "f3fe4b20-9dde-4083-b5e1-e1fd054c44dd", "value": "Shipping documents.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b42ed9f-de0f-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1709986776, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709986776, "uuid": "16753c64-2d8c-469b-addc-8fd7dbc8d7af", "comment": "Malware payload (AgentTesla)", "value": "f842c007dd19b2120a76d4a0d8d27a9b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709986776, "uuid": "f39b60c0-ce64-43db-bbc6-8aa1fbd2e0c1", "comment": "Malware payload (AgentTesla)", "value": "aa99c07203568e2616875fcf1094ffc5225cc72cd31aa52658a3018991525c0f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709986776, "uuid": "8a7f0b39-af37-472a-b292-e3e6703bfab7", "comment": "Malware payload (AgentTesla)", "value": "f08d3b22eed467168c5cf535cbf8cee00a15ce69", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709986776, "uuid": "373fecbf-7a8e-4aaf-8934-2fe29c580c98", "comment": "Malware payload (AgentTesla)", "value": "17a332c4d963f4bc3c392125399939eaa566bcddffc9d9dcc95bd6875ab426a2a156284f5a90d85d7c05ee3922c8ad61", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709986776, "uuid": "90921fa5-e1fb-4f96-91fa-a8cab6415c3f", "value": "T12BE4D09863E8875AF2FF177BE4B405208BB7F956BA3AD79D0D8464EA0452F10CD20727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709986776, "uuid": "acd32e5c-06da-46e2-a4fa-dadef5d25290", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709986776, "uuid": "62fb228b-b5eb-48c1-9fbc-c59684950789", "value": "12288:oymXNjZLA2CtNFeEMGLFEF3yhnpU4rSHcyISFOp9gLMzn:ntt3etYTuEpgI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709986776, "uuid": "91f7a043-a582-428c-b35b-f523d641994b", "value": 680960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709986776, "uuid": "cebaf5c4-4132-4509-9ba0-e2dfdb79196b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709986776, "uuid": "138807e5-d2cf-45d3-a852-69506776d9d0", "value": "f842c007dd19b2120a76d4a0d8d27a9b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c91ec605-ddb3-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709947473, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709947473, "uuid": "eb4077b6-d8fd-49b8-b562-0ad6800b5bc7", "comment": "Malware payload", "value": "1538d02b20894ff1dc84a770a9288bff", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709947473, "uuid": "958b4d05-4788-414e-92aa-51de76286f96", "comment": "Malware payload", "value": "ae24a393c4f0c922743214c03a422927af7dc452ba4017a98f10c7873a385522", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709947473, "uuid": "924604b3-007a-4963-820b-1957ae11955f", "comment": "Malware payload", "value": "942fdcfe2de65c4801e4974bc257681fce7206f9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709947473, "uuid": "9a5b3206-2bf0-46ec-b539-ca6b76d33f75", "comment": "Malware payload", "value": "a1f9e5eb43e4eaac2a91be8e578ae571eff5b827e62efff90c2952d868e212d1baa4e6ef200ca4b1940a3177ff6afb04", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709947473, "uuid": "7e6b87bc-cb7c-48c9-aaa7-c6d8eab06f67", "value": "T13895E052769150B2CE2382715F3C6E35A89EBE505620C78373C9BE1A6973AD1CD273F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709947473, "uuid": "2e4260ee-a4d4-44ce-b33c-4d85b163405f", "value": "bd9208ee3b49843f33a3af9bb81f7516", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709947473, "uuid": "897be627-0f42-4f1e-93e0-0da63fa6eb54", "value": "49152:/NdS3/59vUGFMtPMiruD7irX1JSa0aEO+fG:/A93MtmirlJ3EzG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709947473, "uuid": "8510b947-b756-4e1c-adf3-b04a51be03d3", "value": 2041336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709947473, "uuid": "f08ee26f-8bc3-4aef-81ba-ead1e47b0538", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709947473, "uuid": "bdac954d-fa8d-4c4b-aea2-204ac85c339f", "value": "SecuriteInfo.com.BScope.Trojan.Injuke.22236.6435", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d598a95d-de08-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709984001, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709984001, "uuid": "79625d26-b912-4777-92bf-1e47d4338ee3", "comment": "Malware payload", "value": "7b42ce0bb387ae8a452136da404bf6b0", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709984001, "uuid": "0c92b8d7-c1a8-463c-a80c-ec593471f5a5", "comment": "Malware payload", "value": "af19101a9303306e7bb8c3ddb7f1174e43b9b8ef969e78b504545ed6afe42fb7", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709984001, "uuid": "b4df58e0-3191-4194-b069-5c76c48d0060", "comment": "Malware payload", "value": "1d9a116d55be1beb0089e392d5ae342e2bffa8a4", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709984001, "uuid": "cdc65243-4c84-4d59-a777-afaa5b6151b1", "comment": "Malware payload", "value": "3aeda660f0c187e4c32310583db4284f3cd657d6373ec0d14e3845caf9962d0e677f4596c643e6eaf097e4fdbb5c28fa", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709984001, "uuid": "258806fc-1a53-43b4-ba17-984a2cb6c2cf", "value": "T1ECC13C93ABA84DFFF56703BF26664712511BB8A086F5F658378421192870E10CE24BB8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709984001, "uuid": "b78527df-4db0-46fd-a2ef-d6aeca9efe8e", "value": "ec8fcd00e61b25088efb6e707b2d5f1c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709984001, "uuid": "c94fe2cb-2ebc-4c53-81e1-2ad9a6ac6e2e", "value": "96:WvGBPJ7s2zb0UTh76o11VzD73H5fA7tfXxLfA2i:oix710A7lv/3ixX22i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709984001, "uuid": "679928cb-dcd1-4395-b5c5-20e80574c0a6", "value": 6144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709984001, "uuid": "f8f1ed8f-ae27-4af8-9c7a-ece9290afbcc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709984001, "uuid": "41dddcb8-68e3-45dd-99f4-b996bb916410", "value": "SecuriteInfo.com.Adware.Conduit.23950.25116", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8a35f2b-ddd3-11ee-b7ea-42010a9c0006", "comment": "Malware payload (PureLogStealer)", "timestamp": 1709961163, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709961163, "uuid": "852f979e-c29d-4f2b-a25b-ec01f2249c42", "comment": "Malware payload (PureLogStealer)", "value": "ff13c37bf1e2c6dd4c2ea0c048ca1303", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709961163, "uuid": "a7faa975-b03f-464b-9aeb-7cc2f8977d1b", "comment": "Malware payload (PureLogStealer)", "value": "b01e90b9b5de467775e276e222b8c16dbc3f21ede1b29504bf667f32c67239cc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709961163, "uuid": "651527af-5fa9-4317-91ae-821296bc618a", "comment": "Malware payload (PureLogStealer)", "value": "a1efb4fce30c41375a7bea76314e94b371083213", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709961163, "uuid": "f9b3e9ae-4733-4c49-b420-0fffb8a5b387", "comment": "Malware payload (PureLogStealer)", "value": "81de663a82d378b521181f4b097c26424a48a23a715c1641184ebcacf8871ea513b54c319b367718a406b35ccf036474", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709961163, "uuid": "a5209a99-9f02-43ec-9bc8-9229f4c2ef80", "value": "T144545B0EBB6CD913C25C0776E4C7610997F0DC43A223E64979D623D94D0B3E6EA4A39B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709961163, "uuid": "c5fbac51-e506-4d5e-b8df-ced9660abd39", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709961163, "uuid": "4bf9857e-ac8d-4dab-a2e2-21bea926a422", "value": "6144:jkhBwH8D2mU6JXU4lYG5pSntvAk5UZiL2z:ZmNU4LY5Aki0Le", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709961163, "uuid": "7083059c-5aaf-416f-b58b-a96087f2ccb5", "value": 288256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709961163, "uuid": "861a58b8-4ac1-4efe-adac-5b1112801c82", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709961163, "uuid": "b26ef5f7-dbd6-4dd6-83f6-f53327c4937b", "value": "ff13c37bf1e2c6dd4c2ea0c048ca1303", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8c64ae2-ddfc-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1709978826, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709978826, "uuid": "eb40756e-999b-46b7-8043-3d1ee7cc45a1", "comment": "Malware payload (Mirai)", "value": "0aa90246654a9d8d382d5b1ac7ddd0c3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709978826, "uuid": "d186eb0d-1fdb-4316-9738-72c01a86531e", "comment": "Malware payload (Mirai)", "value": "b2966397054a26e57201040da4de094b0449a0f52d1faaa1bf35fe29393b834f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709978826, "uuid": "719ae707-49ce-41b2-bd12-0a1069d3e3e0", "comment": "Malware payload (Mirai)", "value": "7a4634919b158814bd17a41a4676e38048e70388", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709978826, "uuid": "6b638479-6100-4f1c-aba0-c07276b79c1c", "comment": "Malware payload (Mirai)", "value": "943482a5a29c3547a039edf78ee47a2d6da0a34281b86db964d39d7a26b6173b007b3a88fdaa180f1a7e255ccffed9fe", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709978826, "uuid": "07b45d68-ce66-4020-ad27-c6c9a8692d75", "value": "T15704FA1AAB510FBBDCAFDD3706E90B1139CCA54722A93B363678D524F50B50B49E3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709978826, "uuid": "41e2ac6c-496c-4d71-ac85-e6f41fc0d3dd", "value": "3072:uCQDElnTdhX5MZ6vKOgwRl6adAbVNjKK/iy8:uCQQRphaZ6vFg+ljmLeK/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709978826, "uuid": "6b6d8b79-8638-471e-a859-822a8d069253", "value": 177856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709978826, "uuid": "82fbf897-92cc-4f85-93d9-db137c0d11c6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709978826, "uuid": "8cba2203-d21e-4897-9f7b-be0c5b1ca44a", "value": "0aa90246654a9d8d382d5b1ac7ddd0c3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c08f96e-ddcd-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RiseProStealer)", "timestamp": 1709958538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709958538, "uuid": "0cdcd5b0-a91c-4ded-9561-935790527cae", "comment": "Malware payload (RiseProStealer)", "value": "b017088437ebdafe75a9731de111ae9f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709958538, "uuid": "dd9380c4-c5b9-4ac8-ba8b-2ec90e27ebe1", "comment": "Malware payload (RiseProStealer)", "value": "b51ec4fec1b43ce51c5f6ed8c3b276c433626cfd930fff3ca9bcadfa9000f87e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709958538, "uuid": "8a45c267-634a-46f1-a996-eac672ca866b", "comment": "Malware payload (RiseProStealer)", "value": "d846dcb1fb68f478538ad964611ee9ff28101586", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709958538, "uuid": "45a4d4d3-8247-442e-896b-289a89c03be3", "comment": "Malware payload (RiseProStealer)", "value": "c7dbe87a6b8506ead05b275c2cfc4eda19d51ee8f817a545cfec4c699bf27c4fb8d5742a42fa51226962be0588fd9146", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709958538, "uuid": "13c35df0-de25-4e8f-a52b-930a8eaf0a12", "value": "T16BB533D499B210A5FC3347F5D4533952031BAC97A93EA06C3A14F7DA2BFE232C156E4A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709958538, "uuid": "85e394c9-eebb-413b-9c54-f1c5fe00c6d3", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709958538, "uuid": "4066b1a2-708c-41e3-8794-77c50ad127c9", "value": "49152:hY5G1MG0WjHqAqstAouruvjsevyy+TZ6/nN9J:hY5yM5sKvstAR1evv+VIJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709958538, "uuid": "a18767a3-1f02-471f-a6bb-dbd17cd08fcb", "value": 2343424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709958538, "uuid": "0422b32f-8f51-4d78-bb29-73bf3bc2483b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709958538, "uuid": "392ae227-fd6b-4fdd-930b-f4429834c97c", "value": "b017088437ebdafe75a9731de111ae9f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e81ea26a-ddf6-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1709976302, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709976302, "uuid": "b319f148-081b-4bae-a3b7-fd8d4c753c1e", "comment": "Malware payload (Mirai)", "value": "0444ae3559d16476873488e63818ccc1", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709976302, "uuid": "c51a8467-9257-4038-bebb-9cffc1a9d03c", "comment": "Malware payload (Mirai)", "value": "b876214fdc9c9194c21743c8a73bb6b9339435d5fd8b0092930e7d4c03772ae4", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709976302, "uuid": "3069e64f-15fd-407e-8d6b-361dc2b8e451", "comment": "Malware payload (Mirai)", "value": "e8222e9cbc0baa683217d5b71f6f3f2e480f78c4", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709976302, "uuid": "00c83a03-03de-47b6-a198-b76ac8976281", "comment": "Malware payload (Mirai)", "value": "57ccc7edb35997d54b108a136f69c238ef6d9baa24c67373616683ecf0c6d1a0805fd92c8e93bb0e9812c6d98ec207ba", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709976302, "uuid": "d7ccb335-8996-43a9-a6dd-fc2069f5372d", "value": "T1ED04881E6E228F7DF66D873047B78E259B5823DA27E1D640E1ACC1105F6039E641FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709976302, "uuid": "f9e5859a-9ccd-4410-9155-aee1cc6d1224", "value": "1536:T16zePrQiQY3a6Y05Y9vt6Sw6cFL+z14R7oOe/3LM76qfTOSV2dLi6jyfj2dN:TnPvQHm46SKFahy7ox3LIS4OLnyfj2dN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709976302, "uuid": "e20e6556-d051-4d9d-9a12-a5a42ccfe690", "value": 173824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709976302, "uuid": "aa4440e4-0cdb-46ed-8756-64226f730c66", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709976302, "uuid": "f59235f0-d030-458d-ac05-80b683dbfeec", "value": "vlxx.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0f5e352-de0e-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709986624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709986624, "uuid": "006bf198-9f74-4be9-b471-6e27b79034f3", "comment": "Malware payload", "value": "181882bfc386787cae2ceed9ddf80b9c", "object_relation": "md5", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709986624, "uuid": "70e85923-3d70-4967-aaa8-255cac71bc55", "comment": "Malware payload", "value": "b8c92d1849f70da00413c5c9da74fe7dcf46b54ef5391f0ab5725a5041873d78", "object_relation": "sha256", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709986624, "uuid": "c35e9e63-dc3d-4e67-bb4b-1b65a0d2ec54", "comment": "Malware payload", "value": "501e34bbce935bbb9a0a3538cf0162c07a48d338", "object_relation": "sha1", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709986624, "uuid": "1ca6ae12-aeac-4da2-9a71-4ee6abaa9206", "comment": "Malware payload", "value": "69738afd5673693da7ca5cad687146a3ad30a4b01404cc0f75dd5d084727123a0e827debe356f671b772e273d29df655", "object_relation": "sha3-384", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709986624, "uuid": "36482dad-7963-48e0-8c09-a72a067390d1", "value": "T11B019740004ECF32D930733E426200868D1C3A82A29BC6A038EC8D9823FC43E2C8108F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709986624, "uuid": "68de6024-a8b1-43cf-87e0-8064292f8bc6", "value": "6:GGtGTFgtGTF6VkEc4v7QN8SGK8PKThYVkEL/2aHZJODl:FtegteikEhv7QOSGbssds", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709986624, "uuid": "937a41d0-de1f-40cd-a3e4-ef7fbb7ba75b", "value": 677, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709986624, "uuid": "33e752e0-fe63-4ed2-9c79-0f780bab1151", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709986624, "uuid": "7ac45fad-8600-4631-901f-2211b56a5366", "value": "181882bfc386787cae2ceed9ddf80b9c.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "213b6f31-ddee-11ee-b7ea-42010a9c0006", "comment": "Malware payload (GCleaner)", "timestamp": 1709972532, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709972532, "uuid": "5069d78c-a35b-475d-a1eb-c8580639a1bd", "comment": "Malware payload (GCleaner)", "value": "125c20de28795b115fc57f281612bb1c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709972532, "uuid": "397aed28-4713-430f-b0e0-b91c49cb7915", "comment": "Malware payload (GCleaner)", "value": "b9dd5b5112232c3266b326271d24c2d8af866a386c34fb2d4cd3c414f995b587", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709972532, "uuid": "0328fb28-1ec4-4a98-bb72-9d4050d3b16a", "comment": "Malware payload (GCleaner)", "value": "31f3d75c81011a61be69464920fefe97469b2b6e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709972532, "uuid": "e8f76f23-e5d0-46c8-9f17-d3371b8d2564", "comment": "Malware payload (GCleaner)", "value": "cdc29fff892530c6901a372ce7d9baa13d1f31c5f2ab9d5f3a9377bdbcc4af1e5cc06da645525f41cb0a563be7e9daf6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709972532, "uuid": "33996532-2a0a-42c4-a15d-90101fb7db11", "value": "T16B34E012B2F08832D5E355305CB087E159BFBC922760918F57983B7FAFA2AD04A7435B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709972532, "uuid": "d0a5b37b-c8b7-4d77-bbcf-e5a4168bbe02", "value": "2d3b460caa86ad92cecbea0585c3a401", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709972532, "uuid": "2b68fd75-4dd6-44e3-8c21-ef936b60eae9", "value": "6144:+aAutLnZhFnStJfRgKZQdqCxe30RP+Mzb:EYLZu/pdZQs+e30V+q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709972532, "uuid": "f796af20-74c8-4da9-b071-dd13a620e8da", "value": 245760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709972532, "uuid": "893ac555-0b61-4d9b-8ca0-1b49fd3329ef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709972532, "uuid": "ee748c94-0242-4f92-aae3-77c9e32ef1c6", "value": "125c20de28795b115fc57f281612bb1c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32fb8a06-de4c-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1710012934, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710012934, "uuid": "77998254-564e-4d03-8a7e-34ac1d3a81ef", "comment": "Malware payload (Mirai)", "value": "b4353009ce80797e372d661d7790b3e1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710012934, "uuid": "1d0a4314-d28e-4c32-aaca-10246b45c992", "comment": "Malware payload (Mirai)", "value": "bca5627ccd7523fc65d04dcab2eedaf0c358b07ef16b9a21396b15acfff1bd9b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710012934, "uuid": "e87adae4-8acd-450d-ac97-42e2832e1aee", "comment": "Malware payload (Mirai)", "value": "e992d09702569c3c4a258779ddb6689412082561", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710012934, "uuid": "31bee4aa-a021-4929-ad25-f4e3a6331ba5", "comment": "Malware payload (Mirai)", "value": "453e4a6b7362ffc632c2ab1e04e106c08bcb8996c550a1762f4c700ed17c41ad301e359891b63a0f36e3ef07183c3d61", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710012934, "uuid": "fe663f90-bb54-4496-9991-ef40f07a308a", "value": "T1B3F64B13B6E658ADC0D7D874134B9167AD31BCD58121397EB688CF301F62F24A72EB62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710012934, "uuid": "0a59d579-f0f5-4d70-b9d7-68c9ab7abfab", "value": "196608:MjIQcEk+Td5nNZtnwe0yhNkBkVaFKAD2ShAlA:0IQg+TdZPtnwdAkmVa4ADH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710012934, "uuid": "3dbf8c20-6697-4394-b162-f43dbf661e88", "value": 16770688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710012934, "uuid": "bfab2d4f-6b4e-4b95-82fb-d6986da81bf1", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710012934, "uuid": "83014178-252c-40a3-a443-70b927df8b99", "value": "SecuriteInfo.com.PUA.Tool.Linux.BtcMine.9999.1894.25129", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "daddfd15-de37-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1710004197, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710004197, "uuid": "e56808d1-6fc4-4549-bbdd-5736cf974224", "comment": "Malware payload (Mirai)", "value": "81af80d9bc7f1266fa5392afc90022e4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710004197, "uuid": "4d37b374-d1fb-4fb3-9a8d-9bf2a2047e0c", "comment": "Malware payload (Mirai)", "value": "c0518f75c30e25d94220efcf0ff6cacaafc144fec9fc7261e5a88c2e6b2925c7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710004197, "uuid": "a5c5d072-f5c5-49ba-9f4a-fb2503111cc8", "comment": "Malware payload (Mirai)", "value": "101d9425fa15f3da0aa7cb156833abf37c0cb86d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710004197, "uuid": "33c45a53-328f-4fe0-a0ab-31852dc4d31d", "comment": "Malware payload (Mirai)", "value": "9807930d02919bb804fbf74cf7dd71e4f1688b8b7edec30f3c0a0758ef593c8da307b077d94bcdded426545f7e0d0a06", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710004197, "uuid": "579fdbf2-f24d-4a45-9b3f-eb3f96e0ef63", "value": "T15F535AC1A683D8F6FC2A01719137E7365A33E439013DDA87D7A9E832ED52900E7163AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710004197, "uuid": "217f9c76-2852-4203-b927-d0d41cc51f52", "value": "1536:MOf6FP7mQT9+CgAf92NJcJjnLU/LWvdvP8CfVd7c/YCSQv:ff6BaQT9+EMc1nYzWZPfn76", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710004197, "uuid": "4468c80d-454b-4fe0-aaf4-18e8eaaec985", "value": 62772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710004197, "uuid": "00ea0ac6-0a1e-4737-a684-6ca0fd520b2e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710004197, "uuid": "b5a75862-8bd9-453a-81a3-330d7322082c", "value": "81af80d9bc7f1266fa5392afc90022e4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95cd9566-de02-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1709981317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709981317, "uuid": "878d0e5f-d878-4a1a-b3bc-f2d1739bab6d", "comment": "Malware payload (Mirai)", "value": "231c4152023045025fafb84c477266a6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709981317, "uuid": "160b9984-7c6f-4428-8897-997a6b6a9a78", "comment": "Malware payload (Mirai)", "value": "c23667f0f07103b5ee4f141655eee3c9ddc22d1acdee417ff5ef8fa0bd6e1ab0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709981317, "uuid": "24b26fb4-9d3a-4ae5-b842-21754bb7897f", "comment": "Malware payload (Mirai)", "value": "72ec886b86fea43665ecac3fde7b58b9105c87cc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709981317, "uuid": "82224076-eb6c-484b-8042-cd232150afa1", "comment": "Malware payload (Mirai)", "value": "9cce9f48102fed1c16348df1a2273c2d36588c0efed16aa445c254379d5fdab2ca65025e66fda4039dc1a4b52f97151d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709981317, "uuid": "5981fef8-7c1b-4b79-a07c-54dce244d073", "value": "T159E2F170B1E438BCE2D409F0F1EA434657A90AAD74977065B67752E4F0835B663BC48F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709981317, "uuid": "249ecab3-aeb9-4260-a632-fb2821140e9a", "value": "768:8DPzqSFpKCj7adky5RrDCo+Ck1LWRrLfV/wcvB3Uy3:sPzqSFFty5RyPcRLfVL53", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709981317, "uuid": "22d73a03-81c9-48ec-9929-3126442b12df", "value": 33544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709981317, "uuid": "28aff6d9-6e17-4706-80f2-bc581cb3b9c5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709981317, "uuid": "4ab0eeee-1712-49c6-9a78-ad54b5edec19", "value": "231c4152023045025fafb84c477266a6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a48c334b-ddd3-11ee-b7ea-42010a9c0006", "comment": "Malware payload (PureLogStealer)", "timestamp": 1709961156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709961156, "uuid": "c44f2fc9-5cac-4fe9-a1a3-74f95c05f502", "comment": "Malware payload (PureLogStealer)", "value": "03b7fd96167ceb3719c16a808178bcb3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709961156, "uuid": "a973c1d3-c559-4988-85ae-ca82f68afdf7", "comment": "Malware payload (PureLogStealer)", "value": "c4358ea2998d60b3a94d6582331a845a32b9c619b6e6c0935b944d96376bf23f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709961156, "uuid": "d4027442-2761-49ed-86d0-3340ec323761", "comment": "Malware payload (PureLogStealer)", "value": "a009d6fd6627a4c03bc85f8727abe60553067ae3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709961156, "uuid": "398b083a-7651-4c56-b67c-7bfefda88f85", "comment": "Malware payload (PureLogStealer)", "value": "b9bb4dd505040ab8dccae2014c5c8427cce10b06bd095bc7fd133621261788cd78e2f7a344bec15aafc754da50e26c7f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709961156, "uuid": "e70696bb-ac4c-485b-a1de-365227d17052", "value": "T150546B0EB768DA22C26C4776C0C7A10697F49843F263E28979C533E24D173E6FA49797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709961156, "uuid": "09f811ce-b4d1-410b-b603-98261187a14e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709961156, "uuid": "c313b3f3-f622-4006-a7d0-c652ae868d9c", "value": "6144:qoNGuH3kI0SNITyK1KBk1F3eHu1ZYHemZ9AHS56w:1NGbIH9I1F3eH6ZYHemGZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709961156, "uuid": "590d9dfd-a00e-4903-be6d-065a830107c2", "value": 287744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709961156, "uuid": "5a57d45d-db24-4110-9168-6446e735e520", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709961156, "uuid": "e2589928-d355-4ea7-92bf-a6a2c4e38a53", "value": "03b7fd96167ceb3719c16a808178bcb3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc69a49c-ddfb-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1709978429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709978429, "uuid": "152cfce6-142a-4a11-83e3-1aa2a92d6da8", "comment": "Malware payload (Mirai)", "value": "1b29b257f9c6c53fdea542ba2022c758", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709978429, "uuid": "32280669-7862-4953-a9e3-1731e4c7f9fb", "comment": "Malware payload (Mirai)", "value": "c4ae7eb128a4de9f5a4b3296389e64c76df9c36d792e5e9a12cb3bb9d2cac623", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709978429, "uuid": "fe7c19ad-d284-49c8-a7e1-b9f34ec09a47", "comment": "Malware payload (Mirai)", "value": "b43ff9b3ff3e568405a327c6bf61898ea0d5405c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709978429, "uuid": "1511b39d-f2c1-49c1-9e4b-6539aa5ca295", "comment": "Malware payload (Mirai)", "value": "640487c19ce7a57059823ea14c3bd5b995d0c0f762cd87d9063c61c41f89f6258f102a798e656de25393153d4361ae92", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709978429, "uuid": "c9f73b92-3687-4729-b837-02a69174c71c", "value": "T12FE30A56F8819B12D5C111BAFE1D128E37131B78E2DE7312AD246F747B8A87B0E3B905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709978429, "uuid": "ee19e5c3-01c4-45b7-9d03-bee9104ed6df", "value": "3072:0CKuUmbgWz4XFQ9sHwIaOOxGjBPCm3CR5RjQ:0Czpn4XG6Hha9q/3CR5Rc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709978429, "uuid": "7927fdd0-4c83-4810-824d-1f7e526fbe09", "value": 143260, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709978429, "uuid": "b86a4a1e-8fd4-4358-baa2-74fdb8e6a06b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709978429, "uuid": "345af907-d829-48b4-a8f0-003d2009db1f", "value": "1b29b257f9c6c53fdea542ba2022c758", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d411e4c2-ddf6-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1709976268, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709976268, "uuid": "95a2f34e-02e9-4fff-8ba6-d52aa9df066d", "comment": "Malware payload (Mirai)", "value": "ca44dedd8391e3e1fab010e0d32faa12", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709976268, "uuid": "264da42c-022d-419c-93fe-df533341aed9", "comment": "Malware payload (Mirai)", "value": "c51c329212d54bf03dfd035aec0214bc348b010112d95b5b168d4ef57671c6c3", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709976268, "uuid": "e68e2687-2df5-42fc-afe1-1cc6faf95441", "comment": "Malware payload (Mirai)", "value": "3b87b3e41c17cf20692cd98851c1d406dc42527f", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709976268, "uuid": "94be6df8-b613-4646-86a6-e48e69123738", "comment": "Malware payload (Mirai)", "value": "b0e8049d40398800366004d61ad1b04244865ed41e5b4469d5dd820dc9bd47c7933c1cccbf1ba220a4441f17fc0c9926", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709976268, "uuid": "c254a5c7-fdab-4899-a824-f0f71afb5751", "value": "T1D3D33A1BB4C180FDC4DAC5B44F9AF53ADD32B1A81238B16B27D4AB225E8DE315F1DA50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709976268, "uuid": "ed721d3f-ca03-414b-8ef8-9664c9ef9d83", "value": "3072:DX+wXNsuOXWYmqnQwk11TosPipRlOaogXk72IElN7Cch3wGymPd:DX+wXNsuOXWYmCIPuk7uyGymPd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709976268, "uuid": "e20a2db4-43cf-4ddf-acd8-257dfa1e81ad", "value": 139576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709976268, "uuid": "8ce554f8-56ea-41ce-b6e4-a020c006ad61", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709976268, "uuid": "f0c58d2f-57ce-4221-84d8-b90cd1dd5b23", "value": "vlxx.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47f7f77f-de0f-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1709986770, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709986770, "uuid": "e49e8b5b-c595-4646-bf42-d2e88c073be4", "comment": "Malware payload (RemcosRAT)", "value": "393926b3e5346ce762461efe83223f2e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709986770, "uuid": "eaa52ef9-4f08-48da-bd33-bbd7df62948f", "comment": "Malware payload (RemcosRAT)", "value": "c54a85cf5667627dd3ac12dc4ef73670b8a12403ca1010a7206696be075a5838", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709986770, "uuid": "25f13cde-01c8-4a26-b36d-53cfd3de451d", "comment": "Malware payload (RemcosRAT)", "value": "8fd3a833984d6283cac8c074c809fcf89c34f5ad", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709986770, "uuid": "f3bb30fc-d05c-41f6-8d96-56177632bfd5", "comment": "Malware payload (RemcosRAT)", "value": "dae3831a935dab8ebd52597061bd5c343ddd9ef01ebecbdd1869e26bca3cc91687223738befe06d877d6eaab20cbd594", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709986770, "uuid": "98c5a565-cb8d-4c12-ab46-a33760873e7f", "value": "T13D15F16823FC5B57F6FB0B37A1740A50C777F806692AD75E1E84A1FB0402B64C99172B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709986770, "uuid": "2a3296ab-eff4-4bcf-a779-8f525d4dba14", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709986770, "uuid": "a98d93f0-0c6c-48f0-ae94-cb65f9b3fe5c", "value": "12288:OymXNjZLA2CtlFeEMGLCWw7IqulfMzColcrF5P2GRWm3YeaFoX//OI2Te7NrISFt:RttvetQ2IxJ8ColeFBzjP/OD9Ay41R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709986770, "uuid": "520c428a-c86e-4f17-9ebb-d33648868b1a", "value": 935936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709986770, "uuid": "2bda8caf-467e-45ba-8da7-c8d09d4ddd96", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709986770, "uuid": "a5245ec3-0db3-4c3c-bc34-48bef07d7e3b", "value": "393926b3e5346ce762461efe83223f2e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d48bc56d-de37-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1710004186, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710004186, "uuid": "3e7aad6c-9894-4493-9a76-deb1cc601959", "comment": "Malware payload (Mirai)", "value": "c2b138f7a16567c139efb589430046e4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710004186, "uuid": "fbc83cba-56ab-41fe-b73f-6f1f77930f32", "comment": "Malware payload (Mirai)", "value": "c73f839d515a69863b0bd766797932f6cf176bb362a1efe9cb4246c168751343", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710004186, "uuid": "535d0a6d-5aa2-4a6d-bf79-c93d7dcde66e", "comment": "Malware payload (Mirai)", "value": "c654d45728db5fa548457fbcdd46d3e672af622f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710004186, "uuid": "25da0cce-f925-4251-a30b-4a404927138f", "comment": "Malware payload (Mirai)", "value": "84a205abf98bb3ca42b7ebd284b1be48df964359796e80bded6de147f6951cdc40c8aa36a89420558abda892505e8ff3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710004186, "uuid": "46fb3197-c0c6-4083-913c-8e2e776ae0fe", "value": "T194434B03322C0E17D9A21EB0353F06E093BFF95126E1B68A254FDB664639E7615C2F9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710004186, "uuid": "b39969d0-8f28-46cc-8b8a-16e3432b690e", "value": "1536:1t1JILhthQ+1r4atGKmifAKWNGaqd42+8/:1ufh/w4AK+G9P/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710004186, "uuid": "9e328778-5b0b-4d04-a5e5-ccd65e3d4718", "value": 60040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710004186, "uuid": "5714a834-a4d2-420a-8eb6-cba9c0006c8c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710004186, "uuid": "87d96984-9fbc-4eed-9669-c47e20d69683", "value": "c2b138f7a16567c139efb589430046e4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a69c102-de36-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1710003552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710003552, "uuid": "e0a12978-5856-4ad4-8a15-2ea3b78b4d16", "comment": "Malware payload (Mirai)", "value": "99841723aa7c2ccd77395685bf1b0302", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710003552, "uuid": "fe0e4e7a-d5e4-49e9-b145-05a8e485b88d", "comment": "Malware payload (Mirai)", "value": "c838213aefc75a68014fd334eee7ddf45c6d76a9cd7d1769498ccea0916d93c7", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710003552, "uuid": "4a2b63df-571d-40f6-89a8-84a88e134f1b", "comment": "Malware payload (Mirai)", "value": "504446c35d545e519d563f88192686955be5af83", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710003552, "uuid": "dcb437f0-0fe3-4cdb-821d-f73638bb4195", "comment": "Malware payload (Mirai)", "value": "55072d4dc3bc67dce7a5057bca4450397cf71b1d2ebb1409ba7f0aa60819390241a1e8ed273d46b06b1af6c0280b214b", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710003552, "uuid": "0a335730-eb65-4d88-bdf9-8d1d6626eea1", "value": "T1A7937DC5F243D0F5EC8705B15137AF379B33E0B91029EA43D3696972ECA1811EA16BAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710003552, "uuid": "50db6233-586a-48da-97c9-7a7084e653f9", "value": "1536:sUYl80AvyebhzEzASUJ3lIaJi7M30/4GNgKVL4GRUS3tkDNx7:sUYq0ovNHSW3lIPIG4PKVEeBMX7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710003552, "uuid": "d41862d6-15be-437a-adc7-fe4aa768015b", "value": 89672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710003552, "uuid": "3a08268b-7156-48ff-9458-27d819197cc7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710003552, "uuid": "25612d30-b885-4dbc-999d-49369eff228a", "value": "vlxx.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a90dcff6-de19-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RiseProStealer)", "timestamp": 1709991228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709991228, "uuid": "17cdae60-772f-4915-abdc-9bea7c953eea", "comment": "Malware payload (RiseProStealer)", "value": "3dac25b10f2310ae8ca68606da9f7f82", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709991228, "uuid": "e8f71c85-c828-4cf4-9ea0-61c09ba78ea7", "comment": "Malware payload (RiseProStealer)", "value": "c8409d5e5ea9492477c5bb5e9def4526657007f15ef186b2690e41501456ad6c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709991228, "uuid": "c55b34d8-e74e-41e0-a6c1-2f64ffc5200b", "comment": "Malware payload (RiseProStealer)", "value": "6c308ce6ab5fb94defaad7ded1be79b01cf39a43", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709991228, "uuid": "e47a38b4-eff8-4791-ba8b-e0ae695b7079", "comment": "Malware payload (RiseProStealer)", "value": "357fb764867ebecfc66fe85d556efa4e3015f1a204914f7526af0caacb7235cd1a3d0c576664203a316bc3c1893a11a1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709991228, "uuid": "f149b76a-2f6e-4942-b6cf-c8610dc38faf", "value": "T16F56335CAED048E4CCEAD6B05756F5BE79B10FE530C0DC49BD5CAAD3A4E2186DB32482", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709991228, "uuid": "270f45ca-62b1-483f-809b-f5b86dbce4a4", "value": "9a5cb4773210cbe1536aa8965a6904d0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709991228, "uuid": "7afe7515-9cad-40ab-99f6-66a861562962", "value": "98304:8ahKMNysYfMc8sGlNLA2NtLqB7tkfm7iYT94tbqC9aOmyCZx5L1Kg:8wT8McHc/lIYm7pybqC9jmyCr5L1Kg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709991228, "uuid": "61fde05c-aa3f-430e-b45b-ecf8aa50f42c", "value": 6315008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709991228, "uuid": "83915534-9a24-44ea-acd8-b08ca69b497b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709991228, "uuid": "fceccb3e-8999-48f1-8c2a-2710df49a1a2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5eb896ee-de44-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1710009572, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710009572, "uuid": "18041f5e-fc14-47f5-a412-32b03866d15e", "comment": "Malware payload", "value": "bcfaa4abb236ed41f96f175ca0a406b9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710009572, "uuid": "4161a948-819a-4a64-be9a-0b078c9f890d", "comment": "Malware payload", "value": "c8687132138dbd625c7d961d4dfeafd6da937f4c48052b4327ad6a9303063dc4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710009572, "uuid": "252cd6ea-bb45-4a0a-be22-39b0971fdafd", "comment": "Malware payload", "value": "875a7d21d2fc7822e01292643999371e28823404", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710009572, "uuid": "a1276e97-f145-48f0-b460-ad67fd5da179", "comment": "Malware payload", "value": "b8e2d4676d9226c1dd93e998ff3107186083b3cddc630741acdabc67c4aafe2286a03c306f6d2def7e6695b750657b7d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710009572, "uuid": "c32e3700-0d96-440b-a4c2-40f912d919b7", "value": "T19216333BA1848C20C36D2775A493FE558A10C5536B8CE766966FD50BB931BC2CB3B4CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710009572, "uuid": "b1221ed5-b7f8-4dfc-be69-3f229f1ea1b4", "value": "b0e61e0342235167ea6b0cd39dbbab85", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710009572, "uuid": "865d9a5c-961d-48a6-af8d-371392c5dcac", "value": "98304:DjezfWnQE225WlxBP1FTHPwY7hSzmL26WPm4I4pDy3:3e8QEOtFozl6WPm4lF4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710009572, "uuid": "a3f6b9ba-3d4b-439b-9b4b-6c58b7265fff", "value": 4264824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710009572, "uuid": "cb121f49-e99c-4452-8077-991cbad7f230", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710009572, "uuid": "9d26365b-861d-4dbd-b847-4be6dcb1217b", "value": "getscreen-447141406 (1).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9819118-ddf6-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Ahmyth)", "timestamp": 1709976223, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709976223, "uuid": "d30954b4-15ea-4756-94d8-1823eec20e6a", "comment": "Malware payload (Ahmyth)", "value": "59ff51ef565d48a11e6fbb28b2b328ed", "object_relation": "md5", "Tag": [ { "name": "Ahmyth", "colour": "#BA38F8", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709976223, "uuid": "bc7b519e-d28c-46fb-973d-ead7eb29ddac", "comment": "Malware payload (Ahmyth)", "value": "c90bb703a45863aa5e7fdc60a4ad32f933adca82ecddb1c42cf35a17f8078434", "object_relation": "sha256", "Tag": [ { "name": "Ahmyth", "colour": "#BA38F8", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709976223, "uuid": "ebbb5454-017f-44c6-80ec-ce4da68939ee", "comment": "Malware payload (Ahmyth)", "value": "75a1e2b8b6b874168429748ca7fa476afcbe99eb", "object_relation": "sha1", "Tag": [ { "name": "Ahmyth", "colour": "#BA38F8", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709976223, "uuid": "02e838bb-b5a9-45f4-a90f-c238c15649c5", "comment": "Malware payload (Ahmyth)", "value": "df05125cecb119af2e0001abd4fd4c777dae3c871d32a5b81ff6be279d6d9d28a2d66c5058c34f0216e016b800a17c0c", "object_relation": "sha3-384", "Tag": [ { "name": "Ahmyth", "colour": "#BA38F8", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709976223, "uuid": "cca5ae7c-29e7-42f0-ae61-849accd8aa23", "value": "T1E676F19AF788995BC4F3933A89355666410B4C268B43EBC76F48733C18B79D44F4ABC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709976223, "uuid": "fa9c38ff-9b8e-4969-923d-656315e0abdb", "value": "98304:AnFMxSLDfrjbejtaZ0n1MITOsiWBbXQmfIJyEphPgVfYtm+Zd8mzT9CgLCrakdls:AnF8SLDf1ITaWzGPgV08O0vnw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709976223, "uuid": "b2ea6f97-0e8d-4b2b-8804-6a32b2693575", "value": 7192722, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709976223, "uuid": "9e469051-23b9-4fef-ab88-ba1c0ed586c3", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709976223, "uuid": "5b25ebe6-18b6-44b3-84fb-c4e3e17fc3e5", "value": "flashlight.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c47ebf90-ddcc-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709958203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709958203, "uuid": "0ec765bf-839e-4de9-aa14-b72cb5feaf31", "comment": "Malware payload", "value": "07cdfd5d21297f30fbd73d9055f8584f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709958203, "uuid": "8953bd97-5a18-4dde-9b1f-33ccb2ed71a5", "comment": "Malware payload", "value": "ca35238daab477ddfcbda3701df957121898f5604774f1436e58644a10a9a460", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709958203, "uuid": "f48893af-57db-45b3-b0f4-f5ec97a4aa9a", "comment": "Malware payload", "value": "207970846e008fa567e92d2d33f0ae970d9ffdee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709958203, "uuid": "6f5e24df-8ea9-4336-b644-288b6bfa4dff", "comment": "Malware payload", "value": "b021b362a88e54518a0102719044a97a43286e7a907090b49f7ff4671911d0616864de800eda2d90e322a0b588b821d0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709958203, "uuid": "da75da25-78c2-4322-b92f-d31e2c701e3a", "value": "T156B74B512805B1AFD8C977F673D36AF028A2BAD4233688C3E1E4295DD3317D35A3A19D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709958203, "uuid": "c9fb226c-7ad6-43b5-8510-01948cc83ba1", "value": "2a65f7aa1bfff322876f64e89fa9eea8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709958203, "uuid": "74ff1c9c-1efe-44f0-aa60-595af9433f5a", "value": "786432:2H/J1v0O2Fh8jrxFld4eZBWZ/tjGJzjEaghQ6K:2H/Jb/n4DRGtO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709958203, "uuid": "221ddf08-a76e-481d-8d44-e91357bbfb15", "value": 52649472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709958203, "uuid": "b7ae9d22-8bc8-44fd-86d0-3f65e7d66a6d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709958203, "uuid": "6546f180-565c-47af-8145-95dc2f6ad577", "value": "SecuriteInfo.com.PUA.MoleboxVS.17034.22089", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d922aedf-ddee-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709972840, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709972840, "uuid": "a495d8d0-9265-4da5-8b03-687ad8f98b55", "comment": "Malware payload", "value": "db539fe1dc085fd62c1b921a2dbca711", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709972840, "uuid": "e45bc695-9c6d-49e7-8083-1118c1ec63e2", "comment": "Malware payload", "value": "cacc698e9ac3729898e63f2b9df2c78583f275a4b8c68e29066609814eb06f07", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709972840, "uuid": "fe5bfad2-9a68-4823-a72c-63b15b9f6e65", "comment": "Malware payload", "value": "4e478421b2a4026bcf94b794cd68e72d20abec5a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709972840, "uuid": "7281befe-2c0d-425f-b76f-6b6bf366e447", "comment": "Malware payload", "value": "d003c340d86f0c5f99fcc81f7432bd3d19b90d17f914309eb8862b94336c107bab355ec662a82258106d8585b8ba75eb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709972840, "uuid": "a39b053f-aaca-462f-8c90-06002f3724f2", "value": "T13DF633BE4426CC9CD8E0CEBA8C203D96CF05FDAAC4261A2E8E5434BF84B9D745B574D5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709972840, "uuid": "e84f1cac-034c-4eaf-9bb8-a1b375b5caaa", "value": "b1a57b635b23ffd553b3fd1e0960b2bd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709972840, "uuid": "3c821bc1-eb8d-4686-91f0-54a6ecefeea3", "value": "393216:LXZM0XkMGhdIZBsj/nTycuj1mS0S0rcDr:LXZMcryIeLnfuxFrucf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709972840, "uuid": "a9f40070-0356-45d2-b3f1-d6f331b2bd68", "value": 15575000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709972840, "uuid": "85adab92-d858-4ff9-beac-e93c9e53f022", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709972840, "uuid": "fdee742e-d72e-4c69-86d5-f9d9363f3106", "value": "SecuriteInfo.com.Heur.32136.4293", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1298fe0f-de03-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Vidar)", "timestamp": 1709981527, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709981527, "uuid": "52bbd2bd-8fe1-4238-9f8f-1df87395b27e", "comment": "Malware payload (Vidar)", "value": "b6bd183cdd46568127fcd554a4e87c34", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709981527, "uuid": "6402ba45-727b-4ec9-9131-960ab879fa54", "comment": "Malware payload (Vidar)", "value": "caf43337189992332e535b2901da1eac87aa64e5641c8f3c4a57e4700e4e084e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709981527, "uuid": "dd3de183-ecfe-406a-baf7-3424d6473c41", "comment": "Malware payload (Vidar)", "value": "7dbfbc96eb7cf387dcfa41edf5bc76c92f5c8155", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709981527, "uuid": "2ec51a16-95a2-4e84-9ca4-9fc0e6216237", "comment": "Malware payload (Vidar)", "value": "84c8f3ebe949a43b5acb2ecc4d29c7d3db781c1060a0399730223ac693de1dd161a6a64ae9cbf68851b1f58ab7fa6d63", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709981527, "uuid": "e718065a-dc6d-40ee-846f-58ee3189d2a3", "value": "T1E614D02671E09876F9A7593805B596A50A3FF8923770458FA79437BB9EF22C00FB4313", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709981527, "uuid": "714cda2c-4f3f-4549-9351-004cfaae9ba2", "value": "a6a6c071537f8fae36fa27a84ab86d64", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709981527, "uuid": "7332de27-58e5-496e-b92d-cca53cceeb73", "value": "3072:S76CU2PGnNDopnqpi+pDC8aFQVYIPbkU/xMWI+hmyDFLB2:S76r2UfUUCzQV5bkCxMwW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709981527, "uuid": "ae7232a7-ff36-47d6-a297-dcadbd49ec44", "value": 190464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709981527, "uuid": "3bfd3f4e-2eb9-4374-b668-47b792a7c982", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709981527, "uuid": "9e404c38-1ead-4dbb-89e1-bf293b695eec", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36c8648c-de68-11ee-b7ea-42010a9c0006", "comment": "Malware payload (DCRat)", "timestamp": 1710024967, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710024967, "uuid": "46507566-b69e-4f63-90dc-6df9947e1213", "comment": "Malware payload (DCRat)", "value": "bde1d5c0cd06d8bffd57d56074efc5ac", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710024967, "uuid": "981a36ef-d06d-40e1-8ec3-a252cf105c91", "comment": "Malware payload (DCRat)", "value": "cb28f7d6d90b9a08680541160b32e1998912503e07bf27d9df9e5990f819f27b", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710024967, "uuid": "3c6fc9e3-c107-4fb9-9c38-767c88c1bcfe", "comment": "Malware payload (DCRat)", "value": "bf5a4caf1f4f5b6b65e1dc8cebd1c8890d89ca7c", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710024967, "uuid": "543b2f14-b15e-4420-934c-c3e9f20b7353", "comment": "Malware payload (DCRat)", "value": "9d395e771be757ba1822f9942f614cab87ebb88dcaaed0f3e6418ee35f576a637995de353e0cc7b325a48f6a2f5e4743", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710024967, "uuid": "ee253b28-2062-4726-956e-5fa35c740ae6", "value": "T1CB06F10FA2539E33C2B47F3584D7191D62B1CA2276A2FF5B3A5F64DDA9051308B162E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710024967, "uuid": "1dfeb80c-b57b-449e-80b2-4758d3423a46", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710024967, "uuid": "69783fda-dbfa-4af5-8e5d-066f9c90a922", "value": "98304:BImGraieOTYK4HUjaQcDn9Mjpf1OoRELxWdnm3:BImiEOTuHmDcj9kp4oRE9f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710024967, "uuid": "164b9537-85fa-4c63-8761-ac26dc239aec", "value": 3813376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710024967, "uuid": "d4955fd7-b750-4df1-995a-a3408985cfb4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710024967, "uuid": "75a3fe2f-b962-444e-a1cc-eb6d48e1108f", "value": "BDE1D5C0CD06D8BFFD57D56074EFC5AC.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21493f8c-de68-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AsyncRAT)", "timestamp": 1710024931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710024931, "uuid": "8147ccdc-677b-4e34-85cb-3adab1ab9b40", "comment": "Malware payload (AsyncRAT)", "value": "aa8fc5d95c790933704e3cef84c6eb89", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710024931, "uuid": "9ab3f1cc-7eca-446a-b13c-49c3f211b473", "comment": "Malware payload (AsyncRAT)", "value": "cc5488fc5c743d37268f55010af52d78bbaa3fafcb6353dba290b60982a17921", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710024931, "uuid": "cf02c86a-81a8-4b18-8a8d-cde0829cdcf4", "comment": "Malware payload (AsyncRAT)", "value": "4ab0502eb865233b7eaa693de35978b0f8c84328", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710024931, "uuid": "2ddbfbce-88d1-46d4-b7e6-6be3bbf2603b", "comment": "Malware payload (AsyncRAT)", "value": "1f4101e9240a94d933636443def6b67bdfe9d879697a407930972269383fd43b6ea419f12267268cd72802a9675e96f0", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710024931, "uuid": "6a57dbb7-94bf-448e-9408-4cf46b2c662a", "value": "T103F402097BC52442D3A837300FE5C4346769EED93970C22D78E4BE2B73BEDDA6822955", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710024931, "uuid": "9e85dfd2-b321-4de4-9836-f8e5dee4dd4b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710024931, "uuid": "fda76386-aece-4803-8d74-72468673a1b8", "value": "12288:5maxpNBf2kBkD/BBy4gIpgTSV78GgJtnONe/T5fit:5maH+kBkDHzPpTp8GgJtn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710024931, "uuid": "7fd9e0d0-4634-461f-b7c7-1054b17de768", "value": 727552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710024931, "uuid": "aedb6ae4-08d3-47ef-b298-c2f9fffbdf8d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710024931, "uuid": "1a9165eb-1316-40f7-8c31-5ac69b23161a", "value": "AA8FC5D95C790933704E3CEF84C6EB89.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90ca96d1-ddfd-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1709979162, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709979162, "uuid": "3e3816e5-a7e1-45ed-98ba-953221ca1973", "comment": "Malware payload (Mirai)", "value": "f0206417177ba47eb4e72de11b023569", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709979162, "uuid": "c361b0d8-2ac6-4be3-9d8f-4433674581eb", "comment": "Malware payload (Mirai)", "value": "cc950f823cd0bf3065025fa4db84e13e7397a6894efdd2a762ce72f8458530bb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709979162, "uuid": "89e47667-173b-4016-aa77-a2808a3df3f1", "comment": "Malware payload (Mirai)", "value": "265367d96829327bd8af7d3c4ba436d9e4e74181", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709979162, "uuid": "c1e45254-80fd-4fe5-882f-c460672700c9", "comment": "Malware payload (Mirai)", "value": "b1f533a1950e2a6df6b67a761110d18682b1e50466a7b7090bc91f88d2f52cc72d34f3eead2f8a907b43b6e1569b0c5d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709979162, "uuid": "602878de-1821-4dd7-8fc7-517839bb4dbd", "value": "T15B532C96B8016D3CFC5BE6BE40110A19F931366129B30F2BD6A7FCA36D321A65D1BD42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709979162, "uuid": "ef597d42-66b1-4a9d-a42d-b23e4695196c", "value": "1536:Q/vi5Lh7GGukLXHfv+MQ8yheu5q4PG0rP:L5d7RukDH/iW4Oi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709979162, "uuid": "eba4cba9-8020-47f2-9e32-187cef1ed604", "value": 61288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709979162, "uuid": "70d878d6-d66b-4d80-8885-2e271b46a758", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709979162, "uuid": "7c2f868c-3592-4f4b-aa5f-193e52545718", "value": "f0206417177ba47eb4e72de11b023569", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b67cadc2-ddfc-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1709978795, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709978795, "uuid": "f97c1b87-ccf6-4505-8fe1-6c1555c34f6b", "comment": "Malware payload (Mirai)", "value": "fb9f28fbd3b7056ab5fe74614d1eb2fb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709978795, "uuid": "8b2390af-cb86-4f3e-9235-562d80f86b8c", "comment": "Malware payload (Mirai)", "value": "cd01db002fb19d7ca415cb0b1984599d053a072692ec32c414840b996176a42a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709978795, "uuid": "6d8c63e0-49ac-407c-ae83-44bb7cec9140", "comment": "Malware payload (Mirai)", "value": "669cff792c689176b43022e6b0796f8273c82e37", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709978795, "uuid": "3bac7625-51ec-484d-adb1-9853038ce7e0", "comment": "Malware payload (Mirai)", "value": "8d99786199b690e2ccaa1d65103f660613ccc6b2f6d8de2704e66a1c6aa7c1a38d10ced3e6e496a1aa14454b57e23a5f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709978795, "uuid": "7cddf6b3-3735-42e5-81d0-12eed1ee23ae", "value": "T1F33339C8ED97D9F8DC5125712027EB328672F13B1019EA8BE7DDAA23BC52B41D40729D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709978795, "uuid": "23fcf010-7413-490b-9f64-e8a00eb0b8d5", "value": "1536:gAmkKnnAvjccy7ZeDm4ECd+67ZdC2BjWxr2dJKQDfB:nRKnAvjcV7ZIECdxZdC2tirS3b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709978795, "uuid": "9abfe160-767a-480d-b393-9d4baba9d253", "value": 54800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709978795, "uuid": "62dde213-5fe8-4363-9fe0-00eb6d361446", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709978795, "uuid": "0efa47fb-d8a0-4f4a-9477-d18c4f7621ec", "value": "fb9f28fbd3b7056ab5fe74614d1eb2fb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72b7bfac-dde3-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Vidar)", "timestamp": 1709967944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709967944, "uuid": "0af7911a-325d-46c5-9b9b-e1665152a148", "comment": "Malware payload (Vidar)", "value": "1de8a7c44ef488389bb96ee169233ed0", "object_relation": "md5", "Tag": [ { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709967944, "uuid": "76dc3727-2eb1-43fe-9666-142c45bf8bad", "comment": "Malware payload (Vidar)", "value": "cd026317af73e06f743c43a993c58ea0bd1c01f05debf6a713f18f7b10d87b2b", "object_relation": "sha256", "Tag": [ { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709967944, "uuid": "266abd46-2994-472f-8180-e700e06f5854", "comment": "Malware payload (Vidar)", "value": "a7de85632491f98966f68c7f1da734ca0ebf2f56", "object_relation": "sha1", "Tag": [ { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709967944, "uuid": "f5b4e004-1e31-4701-9544-8896120fece3", "comment": "Malware payload (Vidar)", "value": "723e27e916fb0b559176385bf903ef2628235b762292f4ecb107afd592768d2fbe782a8ce40f9000c12f72c2c4cd1b43", "object_relation": "sha3-384", "Tag": [ { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709967944, "uuid": "4eae5df8-4d32-410b-8112-8cba6f401d83", "value": "T11047330AB2A66644C436A2FF818F6178F6417FEAF4F1B378C929601547F936E3F26540", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709967944, "uuid": "646ad4a4-f31a-471d-819e-9bb089ab280c", "value": "393216:1tiTdBPCvRbCBAERvvxRQFzeiDho+DumPBSlKThQI8ItCw8wQ5jynz9v5R5:XaBKtiAERvvxRQptDiJmolKTn8yCXwNr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709967944, "uuid": "82e6b2e5-787e-4289-a8e2-9ee2ab3b145f", "value": 25078904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709967944, "uuid": "481d2bab-e8c6-4146-b3e3-9de0ea1d428e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709967944, "uuid": "67aefaf8-504f-4302-be4f-9c849a25ed08", "value": "Setup_7700_Passw0rdz.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7d1e130-dde6-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1709969429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709969429, "uuid": "46e53430-18c2-428f-9489-bae53200ede5", "comment": "Malware payload (AgentTesla)", "value": "0d509c58ced16b75ce763ce02cf7d63a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709969429, "uuid": "cdb38b9a-4d1f-4069-9ffa-d65762284573", "comment": "Malware payload (AgentTesla)", "value": "ce2abc61cdbc8b673f52d65a3ba61d5e8d21b4549000324f1bd2c7d9486c0d3c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709969429, "uuid": "eceadd2c-ab41-46b6-a0f1-2146d0220a90", "comment": "Malware payload (AgentTesla)", "value": "18983f6c64700f23f9aced31fabf9613ff48bc85", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709969429, "uuid": "fc19c14c-3ec1-4d91-b073-c62f736c413a", "comment": "Malware payload (AgentTesla)", "value": "8d661f48be6c73e292352d0145a7916ac5db88b756c5dfa75bf04447a95a8de8b2abdce2bcd15eba0ef252a698d4e5e0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709969429, "uuid": "af4ec366-3d3d-4de5-be1f-788f72f6a525", "value": "T1B2D423338D7B69F2220068D96D730D53E168C32169AD9400AA36D578FFCAFF65ABF111", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709969429, "uuid": "0f79f03c-9471-4903-8c62-f1eb1a43d74e", "value": "12288:PyYRr3AKFN6HvjPJik1AO+2IRnJLGZ6B6rZ8VbJ/7I3huyavqNq:jR8KFN8LTAfXJK8eZoJ/PytNq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709969429, "uuid": "2416abc7-8a39-4e80-9682-4d6566dde475", "value": 634973, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709969429, "uuid": "3a1a4e6f-4d35-4f77-a054-228897662e47", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709969429, "uuid": "c51fe9dd-6772-4974-b3bb-a2d8bedaebdf", "value": "New order.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba9bee6e-de66-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Pony)", "timestamp": 1710024329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710024329, "uuid": "3f81358b-8816-45b0-9631-76843bdb5d4c", "comment": "Malware payload (Pony)", "value": "a7bf3100ca96672c6e6106da6d13938b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710024329, "uuid": "f9de8876-ca50-420c-b881-3f048983e339", "comment": "Malware payload (Pony)", "value": "cec9aca3fbeb327da9fef0e45b5fde14cf418e6efe43f7d24e1ea1a4b512d0a9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710024329, "uuid": "9303ef3e-000a-44be-abb4-801a721e2f53", "comment": "Malware payload (Pony)", "value": "314bc39647b3efdc5eebe3a60d23cb7978532490", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710024329, "uuid": "6aaeb7d3-1e20-41a6-b58d-5b6e104df9a8", "comment": "Malware payload (Pony)", "value": "ad104209df938d28b9c0428a3cd118c66a39409ddb76b6c9c04da0bfc979eb706003ae1104aa88996c2a74644a10ab8f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710024329, "uuid": "1f26ec8b-1519-4245-a6c0-d3cc3d0f3882", "value": "T1B5A3F803F480A0F1C1A12BB177C157B0E7FD9E797C7A8D5AEF8C48896DA26877B16442", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710024329, "uuid": "e3d97ab0-2da8-4c3f-84e0-631122fcae88", "value": "17768dcb451276f3d0539455414972b2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710024329, "uuid": "49cd9341-16d2-4501-a2aa-63e4b84b07c8", "value": "1536:cXR7yfMqTeziUiwFowdlte3/OW4fCSW0YODyipGTvLETePX2kzmc:sRkfUrFVAvHOeiaETeP2c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710024329, "uuid": "cd8a540d-81d9-46b1-91ce-5a6890526f1c", "value": 106497, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710024329, "uuid": "3a531623-c052-42a1-8161-2626ebbec7e9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710024329, "uuid": "65ca25d9-d7ff-406c-841d-6aa03b4e4cc4", "value": "A7BF3100CA96672C6E6106DA6D13938B.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb744253-ddf6-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1709976307, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709976307, "uuid": "16eea9d4-2c0d-4659-968f-10341bea1b0e", "comment": "Malware payload (Mirai)", "value": "309ada972d585474f57f7e21d9ca2546", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709976307, "uuid": "8386b4ea-c9b4-4a4a-ad66-e81ccf9aaffb", "comment": "Malware payload (Mirai)", "value": "cf65d918a9fb043a9edabc20c96754dcdabd4df07c32044729b9c6cba83e80f7", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709976307, "uuid": "4f29a17d-1735-4a95-ada6-2b1e2205d04f", "comment": "Malware payload (Mirai)", "value": "af81eac8daa3a8b93c820fdaf909039a2a6e1c2a", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709976307, "uuid": "a93747ec-9a89-410e-bad2-100b2dce3427", "comment": "Malware payload (Mirai)", "value": "ed697ce8c0166de9c44b37d12317ffbe6043e7564ef59c57e74ed25da41a82fd7fcecbd99d678197520e2a93220e8bde", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709976307, "uuid": "a4912485-3778-4610-a069-42f410db4e78", "value": "T1E304FA1AAB510FBBDCAFDD3706E90B1139CC954722A93B363678D524F50B50B49E3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709976307, "uuid": "b84e6519-8d8b-4195-90af-6fffa30237c9", "value": "3072:uCQDElnT1hX5MZ6vKOgwRl6adAbVNjeK/iy8:uCQQRphaZ6vFg+ljmLqK/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709976307, "uuid": "124a1ee9-5265-484a-ace6-6c678d5783dd", "value": 177856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709976307, "uuid": "28997c8d-5820-4024-956c-964f0916ed65", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709976307, "uuid": "c42ed5da-fa0c-4af2-ad10-830889afa4a2", "value": "vlxx.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5d70318-dde5-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709969023, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709969023, "uuid": "6383a819-3b8c-4d7c-bc44-f1523e70bfe6", "comment": "Malware payload", "value": "60969260aeb1e6283aad1b1c9b745595", "object_relation": "md5", "Tag": [ { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709969023, "uuid": "676380f2-8e7d-493d-9b26-b6cc0fb548d2", "comment": "Malware payload", "value": "d2b501d33572428ab388caf9b6d2a7f82e3d239e08f37c0313eba99bbc8e3c7c", "object_relation": "sha256", "Tag": [ { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709969023, "uuid": "97c27ec0-30bb-4789-b7b5-ef4ac49dd1dd", "comment": "Malware payload", "value": "c16556fd6212c56c09223512b5c51cee144a6f1e", "object_relation": "sha1", "Tag": [ { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709969023, "uuid": "6c041719-ee42-45ab-9bb8-d7bb47da0731", "comment": "Malware payload", "value": "d5dfa92a5234aa365c8ac8cfb3db1ea9d643163d96f2aa2b43a34e472b02460e3ed297581dbc0ce7665f53afba9b1323", "object_relation": "sha3-384", "Tag": [ { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709969023, "uuid": "4fe40ea1-8638-4c82-8ab7-12791aa0a728", "value": "T1B5F37868AC6D559ED18B88981B9F749103FCF49FCDFDA42143DFD2334EAAC991A83046", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709969023, "uuid": "4ca0e985-37b0-417e-9cf9-5c82f6c1457f", "value": "768:J+daLlBjJWJWcbzE1DiLKBzVBzhoUTV4azbPzfgytDW92xwHPkytDW92xwHPcCNQ:RchqXJvDRQO1OVAaon4NO4z3GO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709969023, "uuid": "849f13ae-38b4-40d0-ae89-4426163ac422", "value": 172488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709969023, "uuid": "6f4defd8-4a8f-45d9-9535-a3c0bff0f106", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709969023, "uuid": "0a7dc74b-7dd3-4cf8-ba5d-ea5d5550a581", "value": "SecuriteInfo.com.Heur.31658.368", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f025061e-dde5-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709969014, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709969014, "uuid": "5eef9cf4-742b-4d70-8d93-0860d36ce5e5", "comment": "Malware payload", "value": "dda6cbd6955f8269853407e105b46454", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709969014, "uuid": "1f061449-d76e-4cce-ba36-33cd9f4ee66d", "comment": "Malware payload", "value": "d344affc5d98f9a3c0da71a868d4909e8f0e4e115fc5107ec285edcc3d351c5e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709969014, "uuid": "5944f609-da79-4f5c-a7d7-b06f42e5feeb", "comment": "Malware payload", "value": "6d72eb823a0312876faafea6f892231a0993eac6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709969014, "uuid": "dcc5b38d-ac65-4088-991c-648df16fca6c", "comment": "Malware payload", "value": "31ee0f3658ee36c93183b587acbaa52519e69dfc041a898581eaaa0ef3772de56d541758f2aaa07e6a7ffc692e8505a1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709969014, "uuid": "c635e8a0-ae4c-431c-ac12-a1af591ddb35", "value": "T10503C733A105D546DCB6D9F12E6F178D6A997A740F408687F3C07E2DA876AD2A63030F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709969014, "uuid": "eb53d49c-c140-4aa0-9882-6d0b827aabee", "value": "f0639018dc9e5b7d28b24809033d27d8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709969014, "uuid": "1a7990ad-255b-4573-8b80-16730c9c4150", "value": "384:0vf4GqgtXhvG4ZRnPllpofGG1QGuZ3Mlf6HaPb4:0vf4GvXlGoRtlqhGZMlfbb4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709969014, "uuid": "ffe69a28-7b85-4c58-a1fe-ae9986fc5d46", "value": 40960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709969014, "uuid": "bdbe99b4-7422-4023-b16b-bc90590934f4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709969014, "uuid": "4f80e9e0-1845-4204-9030-14b538c6749c", "value": "SecuriteInfo.com.BScope.Adware.Presenoker.7586.20375", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca5dd2b7-de31-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Blackmoon)", "timestamp": 1710001592, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710001592, "uuid": "d8d1850a-b8dc-44c0-acc7-dbfef5f56e11", "comment": "Malware payload (Blackmoon)", "value": "5dcd89937ad8ee90d1155c6d793ca04c", "object_relation": "md5", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710001592, "uuid": "3de10e62-0712-4ee2-b161-3fa89e4c1a3e", "comment": "Malware payload (Blackmoon)", "value": "d3734415626267920b540b82bc44197dafe3e8be4f0b0593d970caeb6b56060e", "object_relation": "sha256", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710001592, "uuid": "6df2a8db-4551-4bb6-b016-0d8bf7c4fee2", "comment": "Malware payload (Blackmoon)", "value": "ac532b07ce5354fe3922e8f9e4cc6d74d9f37b1b", "object_relation": "sha1", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710001592, "uuid": "c6b5ac2a-df7c-46a1-ac7c-4b24d15202af", "comment": "Malware payload (Blackmoon)", "value": "a88b9c58d4dca5c55a280bc48f816bee692a6d9f0ccde0c59dda6293cb25aaae0672b845559722dab6b779f53dbdbedc", "object_relation": "sha3-384", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710001592, "uuid": "ede97e1a-5749-4e89-8130-78c7419b4c7b", "value": "T163541286619A57CECCCD0CF6E8ABE50772032F101B5B35A5E9E9351FACB27707EA4150", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710001592, "uuid": "001663ac-9c21-4599-8a88-635495447806", "value": "24e336a50af2ac9d3927a5ad5294d07c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710001592, "uuid": "7e679e54-d5a0-41f5-864d-c735f78f5551", "value": "6144:uIo5X9NPqrz9CoErIVCA9RUHsOYm6Smpz0UCevA9gEBjoS:uIuSc+VcV96SUbZAt9oS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710001592, "uuid": "8e5472ee-6871-4f33-abe1-4ae9adb7a7bc", "value": 298496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710001592, "uuid": "4052ccc6-3a63-4ded-88d2-f7cf938a1928", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710001592, "uuid": "cb271823-504c-4e32-9017-70a12e7bba80", "value": "SecuriteInfo.com.FileRepMalware.16710.12745", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c716fc8-de38-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1710004280, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710004280, "uuid": "551265fe-3894-45d0-89fb-fd286f60a2fe", "comment": "Malware payload (Mirai)", "value": "823b7a97a1bd003183b786f732a9de33", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710004280, "uuid": "4f177a86-857a-4072-b0a1-e76973a7c0ad", "comment": "Malware payload (Mirai)", "value": "d4062b2a980e5934919bc4385edeff9b056a9e6afcb4b1204cb59ed85717fe98", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710004280, "uuid": "ba7689f3-4fe8-486b-985f-d69e383e5557", "comment": "Malware payload (Mirai)", "value": "7e36d6294d99c9ec6eaec7a25ce420bab409260b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710004280, "uuid": "887d8c49-4cf6-4456-8d94-b664553fdc5d", "comment": "Malware payload (Mirai)", "value": "bedd6a1b7e5e695560db0f402bff1557757fec46b402f56dc0a04b326a9a50974db4cf7d7beeaee62f54bc970ba54549", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710004280, "uuid": "e6c8e787-8b96-49f9-bab8-24c9b3eb01c5", "value": "T198531795BCA28A12C5D463B6FA2E418D332663E8D1DF3207DD216F1137CA82F0E7B556", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710004280, "uuid": "615a0326-5391-48e8-936f-a421b62bdbae", "value": "1536:GmxLM+eDqnWcjv6x7WSkAXrl058rj2yBWat5zrK6xAQ:lxQDqnWcMZqK3TbzG6xX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710004280, "uuid": "ec32a533-360c-46bb-864c-fe3df9ff2934", "value": 60768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710004280, "uuid": "0d5e30d0-4a31-43b3-988a-1972130b21ad", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710004280, "uuid": "4cb5cc83-4f8c-46d9-997e-3a1b190bcfd4", "value": "823b7a97a1bd003183b786f732a9de33", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57a5d934-de36-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1710003547, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710003547, "uuid": "d1eb8d59-aff7-470b-84ba-c816872b7c39", "comment": "Malware payload (Mirai)", "value": "1ea6036b93d76b666c6de78aba67ae36", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "Moobot", "colour": "#FCD400", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710003547, "uuid": "7c4a9552-d9d8-4f99-a60c-a1c2bf737ddb", "comment": "Malware payload (Mirai)", "value": "d49c43ac99ccb942e474ed8ac870786a2750cc5b8507b2aaf702715440bc451a", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "Moobot", "colour": "#FCD400", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710003547, "uuid": "f5e68c8c-74e8-4b0b-984d-5c53b6a235bb", "comment": "Malware payload (Mirai)", "value": "9adbee3853a688b9d0a6571ba19f360e3e700335", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "Moobot", "colour": "#FCD400", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710003547, "uuid": "8321653d-4732-42d2-9071-6dde3a36d8df", "comment": "Malware payload (Mirai)", "value": "286befaf133a5c69b7eff2dcb5e9511f9bc35444c7637d1eabfa6dcb0573d0e6967ba150e09677df9751c4ccf1fd425d", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "Moobot", "colour": "#FCD400", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710003547, "uuid": "cf36ba8e-85c6-4d52-9698-81bd80327574", "value": "T133C31A45F8515B13C6C212BBFB5E428D3B2A17A8D3EE72039D216F61378B96B0E37542", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710003547, "uuid": "62da925d-4ab8-42c7-b9ee-eb80b0c5f2b7", "value": "1536:JR7JW6nG5k8wfaeFAsFY1LAthi4VvtnTV+Lj0oKJmjpChvDGblfmwyw8FAUg4eSo:/7JHgUFXC1Lh4XnR+Lj09YpCtETjD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710003547, "uuid": "60184e6c-6565-48d7-9eb2-e38bd319af94", "value": 129792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710003547, "uuid": "4d32443b-e20b-4752-8c89-c9a15a0c9a5a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710003547, "uuid": "e9050264-121f-4d54-bc7d-38dd18a8ba91", "value": "vlxx.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9197099d-dde1-11ee-b7ea-42010a9c0006", "comment": "Malware payload (VenomRAT)", "timestamp": 1709967137, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709967137, "uuid": "25fbe004-df22-441c-8a7b-c165ec6047ca", "comment": "Malware payload (VenomRAT)", "value": "c75e8906a68b453d14519605dd6e6157", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709967137, "uuid": "59da123e-6dd0-4e81-8f10-85c4da9a97a2", "comment": "Malware payload (VenomRAT)", "value": "d5d61e59e8017d35a8b2c7deb4ab3ea04925ab22aeaa0b1a0daf81935c7ab79f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709967137, "uuid": "9782866c-abce-45e7-a017-fb4eac98c139", "comment": "Malware payload (VenomRAT)", "value": "0c0e65517721b755336c4dc072625a7222d189e9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709967137, "uuid": "ed52d8b5-2f02-4b52-8b95-679a78a9d4ad", "comment": "Malware payload (VenomRAT)", "value": "c66ba72138c0c4040cc2e504bacf6e60e649474125c41d563c0d8901fe13dde60b3a559d9360b18009d5a749dc466643", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709967137, "uuid": "e4ed7b64-9cd9-4e46-b4b3-ecf61d50d513", "value": "T1EB734A013BA88D26F2AD47B9BCF255070EF4D5176512CE5E7CC810CE6A67BC58A037EA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709967137, "uuid": "86f883c0-d2eb-494f-b1ae-7d76ec0dbd5a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709967137, "uuid": "a4312365-f906-4ec9-b7c7-530ab0c27518", "value": "1536:yUN2cxaSOCzvPMVH4CfSzEIVH1bd/HLQzc5LVclN:yUAcxabAvPMVH4C2H1bdTQwBY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709967137, "uuid": "8343805c-2871-4379-9f81-cad4a5983bac", "value": 75776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709967137, "uuid": "526d1015-f223-4d82-88b2-e7647e70305a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709967137, "uuid": "999f8027-53a4-4caf-9d55-637a1ecef337", "value": "c75e8906a68b453d14519605dd6e6157", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6ad5c2c-ddf1-11ee-b7ea-42010a9c0006", "comment": "Malware payload (GuLoader)", "timestamp": 1709974071, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709974071, "uuid": "1b17f3d1-35ce-4b09-8270-7739cffd64d8", "comment": "Malware payload (GuLoader)", "value": "6461f31810f09847cba163755177dd9b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709974071, "uuid": "155d6748-fdcf-449a-af1a-b900f541b5d1", "comment": "Malware payload (GuLoader)", "value": "d5faf8db163d0450be878aff899efb423e61167310a331c1e23c542187e995b7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709974071, "uuid": "3fd81c59-7016-4598-9467-9e42e0be900f", "comment": "Malware payload (GuLoader)", "value": "f3d0edea73934aafcdd261ba6ed1879f5c15e4f7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709974071, "uuid": "15516aba-c2f4-4d06-804b-129c6bdad35e", "comment": "Malware payload (GuLoader)", "value": "ff88edb01f9a4932d0c80677bbf3bf15d900e3cbf38391b88baef5ae0d68bde02288472025b357c869b05a27beebd4f0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709974071, "uuid": "17a1cc5c-d013-48b6-8983-0afdb1dfbe4c", "value": "T100D4014EB5029596EF2142778597EE78AF2F6E38B5C2473213B077B818332859F3D219", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709974071, "uuid": "6089b422-1fd7-4520-9c46-9c5a7d84b753", "value": "e2a592076b17ef8bfb48b7e03965a3fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709974071, "uuid": "7ef12901-9d86-483c-90be-70531591d75a", "value": "12288:04mjiqrwQADtqeawtD/SMrixaXnI39ELRVOw9gapMc/:kTfAxqeLwMrP3I6LRVOGpMc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709974071, "uuid": "658d4494-b8f6-4042-b695-3cf1ccf7f87c", "value": 624096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709974071, "uuid": "5251b694-b7db-4d51-88a8-c211980b5761", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709974071, "uuid": "4457575d-8e85-4a03-848a-25e4d8039835", "value": "Reaeration.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d267b1ad-ddfb-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1709978413, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709978413, "uuid": "59bed51f-02cc-4212-8343-6de5e0e9ec3b", "comment": "Malware payload (Mirai)", "value": "ba2d3c20a3e96b69faca72b59dc1ed1e", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709978413, "uuid": "a9a899ff-3672-4000-b681-e2128c70f6ee", "comment": "Malware payload (Mirai)", "value": "d6dd7417451adc416f0927cd378f88d89d523d7154e59dc3c459bfc6e1eabd45", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709978413, "uuid": "01c8a452-f242-4a0c-a16b-c8a964d345c6", "comment": "Malware payload (Mirai)", "value": "815dce8933a381ef45c708ccbfbae678db80fe14", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709978413, "uuid": "f695a6e9-f3f7-4198-8ce4-72af0dfdc557", "comment": "Malware payload (Mirai)", "value": "0b11914348d30df4d96982c6433e19617de3404c653eb5ff1646144fbe53b71c67ae6b753e0720d12993a60ad1ad005d", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709978413, "uuid": "d5d7d813-c41b-4fc7-9b57-d871d348a6f3", "value": "T105D33B1BB4C180FDC4DAC5B44F9AF53ADD32B1A81238B16B27D4AB225E8DE315F1DA50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709978413, "uuid": "072fc7ea-5ced-4874-b1e6-c7f989733a60", "value": "3072:DX+wXNsuOXWYmqnQAkt1TosPipRlOaogXk72IElN7Ccv3wCymPd:DX+wXNsuOXWYmC0Puk7u4CymPd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709978413, "uuid": "44f53904-7d59-4619-bd0c-09abda1819d0", "value": 139576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709978413, "uuid": "b00fe441-0e74-491c-a2c9-63b1a9dcab20", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709978413, "uuid": "54820ebf-020d-44a4-a245-ec2f95e7ebfa", "value": "ba2d3c20a3e96b69faca72b59dc1ed1e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02e2825e-de38-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1710004264, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710004264, "uuid": "9daa3f07-2963-4d17-8ecb-e84dc99a0829", "comment": "Malware payload (Mirai)", "value": "2bc63a30134ddcdd4f9df654a7758f1d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710004264, "uuid": "aa88763c-15e6-4748-b1d4-497fad3516a6", "comment": "Malware payload (Mirai)", "value": "d7b30d012f3b75d802f358a6efb49e98ce3ef14996ddfaebf95ede16dae02c69", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710004264, "uuid": "4aea8ce7-44a2-4806-b32f-51ec508f8be9", "comment": "Malware payload (Mirai)", "value": "44e0f6b6fe3f8287c2c3766f6e67ed671c6bfcdc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710004264, "uuid": "32da8d4f-a418-483f-a44e-99e8adc83986", "comment": "Malware payload (Mirai)", "value": "a62ee130c3ef2510b1238c622a6f036a281db2be20904e09b07f5bc556ee65e119fa62810af35739b38ff0a4d5464f01", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710004264, "uuid": "763c3588-4599-493a-9013-91fb8db63d32", "value": "T181734B42B31C0E47D0675DB02A3F27E183BFA99121F4F784651EAB4A92B1E365186FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710004264, "uuid": "35fbe548-8efc-44a8-a326-2b28d30ddadb", "value": "1536:tLhOvFdZZ965Eojvx2sykS4rE8UAqJIgHDUUDGlWcmSi3G:mRexZvhUAqJI2DOWG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710004264, "uuid": "52579513-c54f-4d64-91b2-2f6b934166ba", "value": 75616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710004264, "uuid": "fcd70d84-c9b8-407a-a244-7264d7739c6d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710004264, "uuid": "639d3733-4ec5-4a45-83c1-0737af5bb121", "value": "2bc63a30134ddcdd4f9df654a7758f1d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fe7c66d-de09-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Stealc)", "timestamp": 1709984099, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709984099, "uuid": "430c97bb-312b-4c37-8e76-473cbc8c933c", "comment": "Malware payload (Stealc)", "value": "4c504d93bc5027a57e378a815f221f6e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709984099, "uuid": "56acaa2a-ed65-4b7f-acc8-e0d241f9ea0a", "comment": "Malware payload (Stealc)", "value": "d9f6947e1a24842120b34ca9ec3a83ed8ebf8182b853c30514bf6d9086cf7566", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709984099, "uuid": "66b97c0e-6a40-4bab-9faf-f739e16acacb", "comment": "Malware payload (Stealc)", "value": "325b9a4e62d03828fe9012cbb26f9e14c0ec9994", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709984099, "uuid": "8a97055c-de36-4b0b-9ff5-48164769dc91", "comment": "Malware payload (Stealc)", "value": "e886f7450f2582b47179d49e2233186e02c3667519b2ec15b3b3728726f488e7d8e0cec7a3463c8545aa7a06be080165", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709984099, "uuid": "871b8739-e18a-45d3-b41d-165d27b0f9e4", "value": "T12D540152B7A4C436E1E299392574E6E38A7FFD5237B4408F7294772B1EB16C24870713", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709984099, "uuid": "d828cee4-285e-454a-8290-c84204afd315", "value": "a6a6c071537f8fae36fa27a84ab86d64", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709984099, "uuid": "edaa4e71-2d45-4f61-9781-65648e47420f", "value": "6144:tl3MCizd5E8LuEA6bihdxu2aqIcgWvxOT/bGbYveNFMF6:tlHqsN6OhnufqjgWvxOT/bTeNT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709984099, "uuid": "1fec40b7-4046-455f-a042-38fceded9ca9", "value": 297984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709984099, "uuid": "632938e9-518d-48cb-8116-459cf386ea5e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709984099, "uuid": "90d48eb8-739b-4ddc-ac5c-8c1732df216a", "value": "4c504d93bc5027a57e378a815f221f6e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f16aefe0-dde5-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709969016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709969016, "uuid": "234422a9-057b-4bdc-af03-73e31ba0b0ce", "comment": "Malware payload", "value": "f0d52d31c176fe23195aa1398a5787b3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709969016, "uuid": "1ba8603b-bf51-4c25-971f-5b414413a94d", "comment": "Malware payload", "value": "dab1d44ed2296488fa2a40a95b226b44a5ab43501ac133c46374f107492382f7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709969016, "uuid": "d10291f2-9769-48ca-a04f-ed8b753b994a", "comment": "Malware payload", "value": "a48b522a31db3698b0ac4a293eed26646541fcec", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709969016, "uuid": "018c135e-2808-47e2-9faf-d330dd051d23", "comment": "Malware payload", "value": "e91f1d45386d119c5184bead1b79036e3747a679204d77cc94b054862ac7b7a2b1ca33a17d1c48edd0ac59920082fdd1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709969016, "uuid": "05bf8d96-6c38-4ad7-94c7-926bbc972046", "value": "T1A1E4082BF7984A65E52862304EC146F312F3F9211F278B9F335E663938B5D212B55B83", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709969016, "uuid": "eec9ea85-4ce7-40fb-8dc1-d9a8e2f88e97", "value": "6144:BiTVJLIic5ihyoSMUsFtl3Ih9idJC0QrMrlWZJUYHO2hKcICtLFgqWrHuH7Ep2PD:BiJMiOoDV3Ih9ihrG1OfCtLFg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709969016, "uuid": "f5f5206d-fdc2-4028-a913-5cbbf39cbbde", "value": 712704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709969016, "uuid": "9c7c3f85-b99d-4ccc-88ea-bc01026b4aaa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709969016, "uuid": "61bb4be3-d30c-46f8-b125-41ea31b765da", "value": "SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.29746.5398", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd332fe4-de37-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1710004174, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710004174, "uuid": "2f4c0014-79c1-4cfc-9a5c-254db71ac0c3", "comment": "Malware payload (Mirai)", "value": "bd320b8d585af4818a36148e0b6920c4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710004174, "uuid": "0d2d88df-bc55-446f-b469-d6435aab7d53", "comment": "Malware payload (Mirai)", "value": "dac49345f8096b767964cad37a02e2d45f0add6d6ba6ea6febd7d9fbeb815417", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710004174, "uuid": "faba84be-5565-4586-ae3f-6efc3788c838", "comment": "Malware payload (Mirai)", "value": "3675a5c341ae502b18a3f25ba2067a151fcad1bf", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710004174, "uuid": "16bd71f9-a598-4edd-97d8-2cbb6e95d573", "comment": "Malware payload (Mirai)", "value": "c2d4e73f1ec2108f5b3f5e1da956f881500ad628f43676d740f2b191c8d5a30a0824d559041197682a12f5a2a489fd93", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710004174, "uuid": "bc5761d8-9e4c-403f-9dc7-68b056807fd0", "value": "T1F7438E36C47FADA8C5858638A42149741F63F50882A7AFFA9BC587645047FFCF6083E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710004174, "uuid": "60e0cccf-a049-4ffb-af31-5e1e14eb5192", "value": "1536:rHdIcHE2ZwtdW4KWjUKbq9V9R3qLw2h5Cwyd42+:rHFHE2Znnz9ZqLw2h5k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710004174, "uuid": "0d0b4e41-009b-453b-989c-91b0b2a1eefe", "value": 55212, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710004174, "uuid": "acceac0f-8810-4e97-a9e9-de382063a5d8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710004174, "uuid": "0becea18-8a4b-4036-89ea-b7e107452635", "value": "bd320b8d585af4818a36148e0b6920c4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "637e7278-ddf5-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1709975650, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709975650, "uuid": "ba26fa10-52d4-4a6e-bfdb-1021e442af75", "comment": "Malware payload (Mirai)", "value": "1cda92579f4a940dc3bce2ecb08a7afc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709975650, "uuid": "957fcd51-a2d1-451b-9ea6-7276d883784d", "comment": "Malware payload (Mirai)", "value": "dc0827e9e77610ed4a3c08bb7b227e4c35f77989e5655308c5028bc8f4e86b58", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709975650, "uuid": "cbc89340-d4b0-4745-846b-07ed9ad2c484", "comment": "Malware payload (Mirai)", "value": "107400e8d8613245ed8d6327cf17b3700595831b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709975650, "uuid": "3c70ed4c-652a-4331-b4ac-bd77bca90463", "comment": "Malware payload (Mirai)", "value": "f105a214b5ec4645941b4137c952eb8c4684db1120afe2f095ab13875fdcb109ca366539e87eb6d5842549ce5a1119c1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709975650, "uuid": "05c65350-6d36-421e-977b-9f70103a7284", "value": "T1C3C37C86E793C977D483067812EB5B256B32EAB707069F01E37CAEF06E02585701F65E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709975650, "uuid": "6fac201a-4e51-472c-bc42-aefee0fcb491", "value": "1536:uEjg2DrYquEcES9NIWZFkf1wCuGpv+8bTH45xL32veEtjRjiVemapoi0ISSp:uINuEDrWChPDTc2mEJRJmCoihfp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709975650, "uuid": "937da33f-decb-47fc-8d30-c0e7d41c1804", "value": 122959, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709975650, "uuid": "7c9fc5f8-ee2e-4231-a43b-8cf2a508bb06", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709975650, "uuid": "4e2bcb53-5231-46b0-879b-691b4d79c779", "value": "1cda92579f4a940dc3bce2ecb08a7afc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc298d99-ddf6-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1709976282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709976282, "uuid": "ce98680b-6685-499d-9dd3-31c508461c8a", "comment": "Malware payload (Mirai)", "value": "aa6732980690a2c8c7a9b82da8938720", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709976282, "uuid": "5f38fd27-79ea-4f8c-bea7-26533f75f25f", "comment": "Malware payload (Mirai)", "value": "e0a061372aa987863d82017341e0fdfede0eb33b11ce847702026995b44f4cd8", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709976282, "uuid": "e378f199-258d-47b6-9f53-40b91c1158e1", "comment": "Malware payload (Mirai)", "value": "fd60720a92f52e59b0ad92086b45c46e5ddbb360", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709976282, "uuid": "a01870cc-3697-4782-a739-e757ad8fb63c", "comment": "Malware payload (Mirai)", "value": "a197662b299b54216481c1d008622b289dade5ba0f85dfb0d6f0afec55aba0c4b83660611002c29d4b60d0478085f152", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709976282, "uuid": "1294c8e1-87f0-496e-8597-71b006df1dc2", "value": "T1CF042A46EB404B13C0D627B5FADF42453323AB5497EB73069628AFF43F8679E4E22905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709976282, "uuid": "3cb95447-6df6-41ea-a906-e54c4cf09623", "value": "3072:EZHZrVjxrvAqTkYaDsh+OcAc6/HSwBjTm2cJsoyM/RMuWpO:EZ5pxr9oYaDsh+nA9RBPm2+xyM/RbqO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709976282, "uuid": "c8fbd982-ad80-4ee5-a01b-55b38043dd4d", "value": 179803, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709976282, "uuid": "e9950687-a987-4613-b983-0abad1e41810", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709976282, "uuid": "bf22ca2e-0159-4f2c-85c3-d03ee41a80fc", "value": "vlxx.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8989b872-ddc8-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RiseProStealer)", "timestamp": 1709956386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709956386, "uuid": "c5165cc0-e0c0-429a-ad0f-b06d13eec38b", "comment": "Malware payload (RiseProStealer)", "value": "2873ebb433305aed49c5c422b210b38b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709956386, "uuid": "e45ea9b6-0672-4477-9934-6d2da6fbb841", "comment": "Malware payload (RiseProStealer)", "value": "e0f812053915070d6aa8cf050b1a534da666b883fe1a53389eec0197d099c937", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709956386, "uuid": "8cabc245-6812-4bab-95d1-ad6aca189b31", "comment": "Malware payload (RiseProStealer)", "value": "d43ced1fc5ecdec55449f68f302e043467b51621", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709956386, "uuid": "2be8eb02-3f8a-4953-9249-f5a738b813cf", "comment": "Malware payload (RiseProStealer)", "value": "0f216fc55d960b494596c0153d9c4df0699560f4d25e9471275dd48bd4a787a7bc66c811cf2e3cf10c863fabec73e30c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709956386, "uuid": "e44e973f-ffeb-4e7b-913f-acce7033a0f4", "value": "T1C6663384ABC22825D4E950740E96FBBD30BB5EC14F154E1F469CBADEACF3238A133556", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709956386, "uuid": "2fe817a8-40b0-41b5-8910-1aaddd8e5b35", "value": "5fca035c1d9772fed59e3f04779695b2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709956386, "uuid": "8302cf29-6cce-4a34-9278-79fd576dc32f", "value": "98304:U6lT3ZbiOVOUDbKDP/zFZQ65WMwtTfaa0QC2tw9jlCf2PjqlYPGeSBJDcSV9T5w5:UYiOzAzHX8rI2tqCf2GlY+e1SV9T5wLl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709956386, "uuid": "7c9ba06b-6872-4f3f-8208-f7ca21add0a5", "value": 6772824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709956386, "uuid": "59a8b7ac-98b3-4f36-a90c-316aea95bd1c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709956386, "uuid": "a4b7a3ca-9b7d-4be6-9411-0a275366cec5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd7c1f9b-ddee-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709972848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709972848, "uuid": "b9e1aa0b-27ff-41f8-8a41-3f276273ee1f", "comment": "Malware payload", "value": "173d4315cdd33e8a8aba8d0322554def", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709972848, "uuid": "b1a95fde-38ad-458d-a4eb-1f6991cd2a26", "comment": "Malware payload", "value": "e197583514fa600f24a3b88cf6b24102c5c09dc39bad6ac9626bd55f23ff9def", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709972848, "uuid": "f1553b0a-4383-4e60-a709-6a3b15e97e2d", "comment": "Malware payload", "value": "512092bbadfadd550f5bb5bcbe95eb107b342d29", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709972848, "uuid": "db3a6f34-16ec-4f0b-8af6-a11feff4087a", "comment": "Malware payload", "value": "6480ce57767586340a376049560216f88ac8c2ecbff4304c32950af59d78fac0783d59405d0a60e9ce6e4b214a240db3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709972848, "uuid": "cf46b389-2ab4-4b70-816c-51c6f4bd3f46", "value": "T1609733E87BC19E74C40E40FBB5B4D223C2E7E30095DF0C52AA8767D61C7056FA9466BA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709972848, "uuid": "bb56c79b-fd22-4ff3-b4c3-bf9867cfd220", "value": "730491907e677638ab304e28646ba09c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709972848, "uuid": "93fa0ecc-3637-49d4-a7e8-cc244d8c1f58", "value": "786432:lwDuqKzop24fg049AN1rlQZRAqKVZK8phpGEAVExpSOO5bBTkfkIl/:lsuqKzop24fZiATxwAqOHWEXSOGBTa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709972848, "uuid": "ad8c0013-014b-4e3e-9de9-21549fe0cfa2", "value": 42860784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709972848, "uuid": "ed28b1bd-ff17-4ad5-a04d-a6dff55a2666", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709972848, "uuid": "12872cc4-f1d9-4cf5-a570-ec6dcd5c3cf5", "value": "SecuriteInfo.com.Trojan.Tiggre.23909.16790", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56ca7fb6-ddf5-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1709975628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709975628, "uuid": "459ce806-8395-4805-b637-dfe6f5171d42", "comment": "Malware payload (Mirai)", "value": "068645858776d7cc0cf38b39142afb49", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709975628, "uuid": "b56a02c6-df8c-4315-bbe5-b8d70fc262b3", "comment": "Malware payload (Mirai)", "value": "e427c4a8e0004319760bae863e5e1df746f996bcb8780cdf04077cbf91c79c34", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709975628, "uuid": "497f6f8f-e48a-4542-a7d9-8509b39517eb", "comment": "Malware payload (Mirai)", "value": "b183ff19621df465fa12af839ef1a358f706870a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709975628, "uuid": "945c6b92-47d0-4bdf-b0f3-4cbb1266591d", "comment": "Malware payload (Mirai)", "value": "9f1e46acca4f7c82b852eed3ae5b60d59f9dbce7d4a347e958f2289350cc99f0ffb90817d336c90bdfa43eec8365752e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709975628, "uuid": "5da5d129-edee-42a2-8d25-3db8cf52a4f5", "value": "T1F2C37DD7FA01DD7AF845D7374C534A097331E3E14A532B326367366AED2A188242BEC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709975628, "uuid": "7cc37770-aaf3-48f2-acd7-af34e2e4323c", "value": "3072:aizwOqqaeKQekacWVcW0JcWcBsbSc7aexSu1ZYGmGb:aveKQekacWVcW0JcWcB0SNGfZYWb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709975628, "uuid": "cb214877-7b69-4a38-a191-7dbc0fba2e35", "value": 118616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709975628, "uuid": "3e35bbb1-6034-4feb-9ef9-59dcda9f7177", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709975628, "uuid": "f5a139a7-4f5a-44eb-b233-59c0b3892754", "value": "068645858776d7cc0cf38b39142afb49", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abd1b124-de37-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1710004118, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710004118, "uuid": "63e0a465-95ac-4d6c-a486-ebd92e22a22f", "comment": "Malware payload (Mirai)", "value": "752b6bd57bb2604c6cbbd502fd7b2618", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710004118, "uuid": "2efdf867-cfca-4cf2-81d8-dcdbcc6ec336", "comment": "Malware payload (Mirai)", "value": "e53180df648e69fa4e620965b74d3dcca909eafd805da34fc37ed1bd28c8164a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710004118, "uuid": "c1fd1cc6-f3e8-47a2-af23-ddcf27f98b87", "comment": "Malware payload (Mirai)", "value": "a756f25a1afc6ff1a606f63cf6f9b25204efc3e6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710004118, "uuid": "4c843c24-836b-47e7-93eb-2d5a6d419846", "comment": "Malware payload (Mirai)", "value": "aa29b2ec0437ebaebdbac7d68adac4e0d834c5a2ca6b1391d481027c7ea970af29d628400da05159c4fc82a856157a71", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710004118, "uuid": "6596646d-b3f0-4d6a-91c1-460e711ea5b3", "value": "T10C436DD6B4019E7CF98BDBBE81224A09F935722154A30F3BA267FD936C730964C1AD47", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710004118, "uuid": "a0e7d081-76b1-4110-a7ee-e08d86a4e45a", "value": "1536:k22d5uma2qTNWGL0bk3WVs9slnY9iI7VvVkA8o:k1qTEGLryBYbvyO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710004118, "uuid": "12bf7b83-b678-4c7b-aae2-58ba7e4320ab", "value": 59708, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710004118, "uuid": "33a7ed59-c800-4b12-8d1e-c3519e038cc8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710004118, "uuid": "24e6fb16-b86d-4b96-a11e-4c9519636bc4", "value": "752b6bd57bb2604c6cbbd502fd7b2618", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cc14301-ddf5-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709975692, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709975692, "uuid": "d4fb721b-3b42-4582-9817-995536497376", "comment": "Malware payload", "value": "c3dc52cbafeaa3f0b8b5e41475bac82e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709975692, "uuid": "0c5abbf9-b62c-470a-9dfb-d0bede6d4e9f", "comment": "Malware payload", "value": "e5983aa0e277b36ce20e88569c2785d1d814c6ef6e14abfdbbeb5131afcf7dd8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709975692, "uuid": "2f8f59dd-aeaa-4de6-bbf6-fb4439771d63", "comment": "Malware payload", "value": "ee2c23fdbb1b54c17bfe27670d9f556418e14e7b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709975692, "uuid": "408be8a6-1b00-45d0-986e-37b0f9a4e45c", "comment": "Malware payload", "value": "d6c1d3561715ad1f7791dee98d1d6f21bd84998f02f84b0238b229b8bb236e61c4ebad98ce15d6105fecc6ea57c65a7e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709975692, "uuid": "98e2e2e9-4fce-4d66-9759-fc1df9237068", "value": "T149E2F151F0289DE0EAF96BF2DCD6E3412BF26E0A6DD015C68281BD051CB1F6D2542BF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709975692, "uuid": "18de6b9b-f3d7-4960-9922-5e422e7f1ceb", "value": "768:QRRzRH1CSD6jK4RrdrDjrhrEuc5ngNM3j+AZx4uVcqgw02NWX/:Q3DMVNVE5coNz4u+qgw06WX/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709975692, "uuid": "7365ea3b-1ff8-4016-816f-a48ea55434bc", "value": 31224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709975692, "uuid": "396285f1-aeb7-46a5-b289-22fe547e3ad6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709975692, "uuid": "2f16cc9e-efbb-4701-8475-63fffb3d87e3", "value": "c3dc52cbafeaa3f0b8b5e41475bac82e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f538cef0-dde5-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709969022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709969022, "uuid": "690bc431-f986-4e88-af36-d992e4bb5057", "comment": "Malware payload", "value": "423fb42f55d317f920664bf92158f425", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709969022, "uuid": "fe3801fb-f5f2-420f-8f8d-2cd70e9d7d8e", "comment": "Malware payload", "value": "e59874dbe9c18c0dcc668d52217b4cce6bfe7e1e34480c831581972ca11b72f0", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709969022, "uuid": "27ea37cc-c50f-4007-8062-86f058d563cb", "comment": "Malware payload", "value": "f0d3ad949ea099e669d22fb681a96536ba985ec4", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709969022, "uuid": "935db44c-8443-480e-9801-673bf9facf50", "comment": "Malware payload", "value": "3ee4751cd909a7970c3e3e129092f0c340eb715ab8302363e3bcff641e4e4efcc67f6d5f8074353cb5c5e5c0cf881543", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709969022, "uuid": "868ad1ea-58c2-4ba7-a7c4-b8a43ca211c1", "value": "T135E39282EF73CB70CA1583720AE65190EB31CC5C16281B5B68DDB138B5F5DA0B9B678D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709969022, "uuid": "6a3af1d3-fc2c-4108-9854-e2385f3d381a", "value": "3072:3+3WWDg+sgZA7aZMsCJzy0WRWQtKV8cSlplzhQW:3+3WW9VZssCtAjTp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709969022, "uuid": "80d995ff-64db-4be4-b12c-fa925c44a94e", "value": 143360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709969022, "uuid": "99482998-ebac-4c47-bd43-f32aa30c2241", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709969022, "uuid": "bdce87e3-d94c-4375-b54f-01af2f00a7f8", "value": "SecuriteInfo.com.Heur.5345.28743", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f670b4a3-dde5-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709969024, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709969024, "uuid": "6df6c466-36a1-42be-b24a-6406e47786ee", "comment": "Malware payload", "value": "22af6587dba91744faabdca504ba2004", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709969024, "uuid": "bd600bb1-5ada-4f20-a281-3e67a2bad234", "comment": "Malware payload", "value": "e7e59d355110de7e87c9c1ffc528d3eda2214f5c37f8970f41e36e01cfba0212", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709969024, "uuid": "79c6213b-4b9c-40e9-82df-d7d31c413311", "comment": "Malware payload", "value": "625621f1e9f6e41dc352ecccaa980053ad106f64", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709969024, "uuid": "f9d44837-2867-4726-b6ed-2c04729ee63b", "comment": "Malware payload", "value": "d49460e6bb8590999cbd9c16afe98b33e46a71b2bbfc6805cf60fda08010a08bc69efae35ff7cea54c579452dc78d093", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709969024, "uuid": "a839188d-04d7-405d-9248-334a54384bf7", "value": "T1D883C5465141913BF57E9EB11DFF171C27A8AEA50F01A9F383C4AD2D29766E23E3102E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709969024, "uuid": "59b8a651-cf41-41b5-b84d-638bf3102bf7", "value": "b881134b9da2cc355d7b73f4054df0bc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709969024, "uuid": "00d0996b-6c5f-44ff-a98a-87dfbe350856", "value": "768:zLqCIqsI9ivd6L6a+3qMEh8r54dMvKOEBO0X4KQ7uJUJQZEUEq9yaBocy4:ywsvdzpEI0nnGN4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709969024, "uuid": "a72c9278-0993-4bb6-b4d1-a08cd5c3a46d", "value": 86016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709969024, "uuid": "15194179-57e5-42db-980c-442fa34ec8fa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709969024, "uuid": "390793da-bbe6-4def-a47b-96c1825b2e88", "value": "SecuriteInfo.com.BScope.Adware.Presenoker.17042.31311", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab61018e-de0e-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1709986508, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709986508, "uuid": "d35f4c7b-eece-4ced-949e-88adace2c077", "comment": "Malware payload (AgentTesla)", "value": "0b931971d8d00276b7724c8a4edda857", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709986508, "uuid": "bc3a191a-0eb9-4e58-9312-99a98570624d", "comment": "Malware payload (AgentTesla)", "value": "e7f9ec1903b932cc2576efd6e0343dee1f55aae6cab8b6d31fe85c116d0f2b59", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709986508, "uuid": "48c01680-eb0d-4719-b433-285199c78362", "comment": "Malware payload (AgentTesla)", "value": "d29512b934572d45fdad8d5c43b64f551a0a12e4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709986508, "uuid": "a849b309-7954-4eea-9f57-6e8de38a53be", "comment": "Malware payload (AgentTesla)", "value": "4474b8d5c38ff4e738c69cd4f06e748291c1fff75a68031972ea02e6c3690c6a3b15cb014bc12a89e8a40ae4b01a22c8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709986508, "uuid": "85bf48c4-2000-43c4-ad26-8762065ddf42", "value": "T14D35AE0273D2C036FFABA2739B6AB64556BC79250133852F13981DB9BD701B1263E763", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709986508, "uuid": "f23b6980-1cf2-4f45-913e-fbb3045a321b", "value": "afcdf79be1557326c854b6e20cb900a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709986508, "uuid": "fbf17284-f111-49bb-a1ce-e355233f554e", "value": "24576:QAHnh+eWsN3skA4RV1Hom2KXMmHaNeZULbIjr5bcbCW5:Hh+ZkldoPK8YaNeiLya", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709986508, "uuid": "ad51355b-067d-4fc3-a658-a5268e19e457", "value": 1110016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709986508, "uuid": "294c9a40-63d6-4a47-b4a2-f658a5979765", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709986508, "uuid": "f56f1f03-2d0e-4051-8e37-1ad56b5d57f9", "value": "E-dekont_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "636abde4-de36-11ee-b7ea-42010a9c0006", "comment": "Malware payload (MooBot)", "timestamp": 1710003567, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710003567, "uuid": "00a3c6d7-6ef2-4c9f-9acf-f904081cea35", "comment": "Malware payload (MooBot)", "value": "490eaeb7bee9f88f78b6ab0dd9b082c6", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "Moobot", "colour": "#FCD400", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710003567, "uuid": "355ecd15-6320-4c9b-a3c8-80069a9ace2d", "comment": "Malware payload (MooBot)", "value": "ec03e1dfb833739c3983eb6fa2ee0af22e7b3d406c17144d36afa771a620909a", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "Moobot", "colour": "#FCD400", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710003567, "uuid": "b46c3112-2109-41cd-99b0-533edaf180ae", "comment": "Malware payload (MooBot)", "value": "4ea1eb63c60d72f894aceaea1b1c168c4ec3bfee", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "Moobot", "colour": "#FCD400", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710003567, "uuid": "726ac6f7-5856-444c-ae7d-c365d55593b9", "comment": "Malware payload (MooBot)", "value": "31e1f3384bc4335dd788e88fb272dfb1fe7655ed67c48e62555cff9c1f79ba0154c2ed982a2a68b94f90bd8f29cba81f", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "Moobot", "colour": "#FCD400", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710003567, "uuid": "007a3794-2610-4993-9519-42a90a3235ab", "value": "T17AD30845F8415F23C6D612BBFB5E428D3B2A17E8D2EE72039D256F20378B95B0D36942", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710003567, "uuid": "0e37a367-8c42-4edb-92be-60b2c5967a21", "value": "1536:9PTk45W6gJXa0BlkA2zPFuAewIP4VUNGqT+YczMgbVGTcAFml5QFwywAFG1pOSUL:NTkeslkdzFui04MPaYczMDoAnUFmjL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710003567, "uuid": "33184e04-7021-424a-b06e-a31804a2ac1d", "value": 133888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710003567, "uuid": "3d6c97ea-d471-425a-a506-63374f259583", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710003567, "uuid": "cb38167f-46de-4f0a-bf33-c46b3b840536", "value": "vlxx.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef8c8df9-dde5-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709969013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709969013, "uuid": "cafc873e-6029-4f33-bd66-dffeb598f1c2", "comment": "Malware payload", "value": "832ff5494d937942f61ba1de9428786e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709969013, "uuid": "25702b98-47e4-43fc-8b28-fd30a8b29b08", "comment": "Malware payload", "value": "ec5e2c1ec7c67e58bcd68d7cccf3b4520cd0af30abc6830c20749ff5149708b0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709969013, "uuid": "365b745d-5feb-403c-8a1c-08118dcc7d88", "comment": "Malware payload", "value": "cb8b43d82487f22525bd1151221d7f6c34c30d6c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709969013, "uuid": "cb0dbb46-e943-43f1-a3a1-9450ad9a15d5", "comment": "Malware payload", "value": "92285765a63a50d64267112766875a46cfb37a9a04cfd1f6200b0af234ab526fb006497ddd9c3be0f274677ac78921ca", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709969013, "uuid": "6ec7e360-8e39-4a76-b557-03305d0d098e", "value": "T14A723E13A605BE72C90C06334D4796E990E7687E1EA18E1339E81F5F3C71A691D73E64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709969013, "uuid": "fbe3c6b7-5365-4295-832f-8dab8e304fe8", "value": "48:gxK4UsovWaqvgcWS37B7vM1xUxMEI4MlZx1sbCPqo5t2hEa:YruvWae73tveUWEI4MlLICBt2Sa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709969013, "uuid": "91c6d452-59fb-4327-94a7-fa65c63d293d", "value": 16384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709969013, "uuid": "8d8fe8e3-476c-47c2-9aed-3ea270c404e6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709969013, "uuid": "b6ddd44a-d939-4933-9965-78204e8affa8", "value": "SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.26630.19525", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8be6f4d-de0e-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1709986530, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709986530, "uuid": "2dd3017d-ccca-4cf9-9f97-e346cc6299bb", "comment": "Malware payload (Formbook)", "value": "91a10c54d8e405f2742ed5b1d9051e15", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709986530, "uuid": "9b069193-90f3-42ad-bad9-513bc40d5aaf", "comment": "Malware payload (Formbook)", "value": "ecd387d7968f8bf9d10e4d2dc2658738cebbc90757c9d2a1a58752b91a66d0cf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709986530, "uuid": "180c93f7-1da6-42a3-ab65-700ffaa9f3ef", "comment": "Malware payload (Formbook)", "value": "b3d5ea6338dbfe838d1deffffa17ae407fb75b79", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709986530, "uuid": "0260c597-1067-4655-8c48-f8afb1b3e3fe", "comment": "Malware payload (Formbook)", "value": "05ecf3882f2074ecd32b7b8bb785c36f68f987396b6d93d884026cbec675729e348728a6f4ca1df3923049cf753df779", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709986530, "uuid": "87025ef4-4747-464a-936b-bd366c664937", "value": "T15935AD0273D2C036FFAB92739B6AF64556BD78254133852F13981DB9BD701B2223E663", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709986530, "uuid": "fd55f26c-307a-4317-81a3-51920a7a13bc", "value": "afcdf79be1557326c854b6e20cb900a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709986530, "uuid": "5d6fe1cb-4b28-4078-bfae-d0e84faee97c", "value": "24576:PAHnh+eWsN3skA4RV1Hom2KXMmHa7aev18DYG1r7wAy5:yh+ZkldoPK8Ya7aA1gYGxQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709986530, "uuid": "0e31148f-90e9-4fb1-bcf0-658a4da3baa4", "value": 1103872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709986530, "uuid": "5cd7c9f5-4aa3-462b-84d7-95a5cf146a74", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709986530, "uuid": "6a837cce-783f-4861-b464-7bd35d46eb7b", "value": "Ziraat Bankasi Swift Mesaji.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54d235e7-de03-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1709981638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709981638, "uuid": "f8c71ffb-3bd2-4104-bad2-6678513a7d40", "comment": "Malware payload (Mirai)", "value": "7eb6ec54cbac9ef1b6323f9f40dd9fe2", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709981638, "uuid": "e3a47c7c-7245-4487-b5fc-13a91aff99c5", "comment": "Malware payload (Mirai)", "value": "ed3d2932939e29d059226440d63d0084fe38d4c997b0526945dc2c78e84c6ccc", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709981638, "uuid": "616b5b8b-71f8-40db-89f3-c2cd808add04", "comment": "Malware payload (Mirai)", "value": "6edfda6010553c1ad549872df597d391857f96d4", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709981638, "uuid": "878e150d-7912-414f-a440-54fed648d65a", "comment": "Malware payload (Mirai)", "value": "bc0fc4ac84bd82351fe43bf635d44c113fb357fdd155c8d19f12f5adc7863a2b4f636c8cceb0f8eed6e7964dd73b7977", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709981638, "uuid": "723731e3-7242-4034-ae33-c60edb815cca", "value": "T173D33A1BB4C180FDC4DAC5B44F9AF53ADD32B1A81238B16B27D4AB225E8DE315F1DA50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709981638, "uuid": "cc1cce11-35b4-4863-8ccf-6b836cfda1fd", "value": "3072:DX+wXNsuOXWYmqnQlk11TosPipRlOaogXk72IElN7Cc03wDymPd:DX+wXNsuOXWYmCFPuk7uVDymPd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709981638, "uuid": "7676d5d0-f4c0-482f-bce6-9bbbc492e8fc", "value": 139576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709981638, "uuid": "6e570242-732d-4c56-bea2-1657cf2b8a7f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709981638, "uuid": "21e9d313-50ef-4499-8ae5-87f96026a5fa", "value": "7eb6ec54cbac9ef1b6323f9f40dd9fe2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cf7637f-de4a-11ee-b7ea-42010a9c0006", "comment": "Malware payload (DCRat)", "timestamp": 1710012012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710012012, "uuid": "0b121826-37fc-4ff1-a785-90d1cbc0fc99", "comment": "Malware payload (DCRat)", "value": "61b0c139a4a8bcc92fe1cc2346b38cd1", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710012012, "uuid": "4931412b-8f31-40ea-a524-ff512c934829", "comment": "Malware payload (DCRat)", "value": "ed566ecf9195704e439e8b78ec414a36ecdaf0353b491d954a08e67a6d5d29e0", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710012012, "uuid": "6cb90ce2-c600-4f7a-b60a-840f31de0888", "comment": "Malware payload (DCRat)", "value": "bea05b2a269501cc2bdcf5d871b1f2e0f149d1e4", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710012012, "uuid": "454e1ab3-c191-4f54-af82-e298faa29950", "comment": "Malware payload (DCRat)", "value": "dc0cc9bf485308670c8dfa894eab79b9ac8fcc4987a0591f9e66db051db9d84f875832090f487171cf411d66da4c0494", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710012012, "uuid": "1c450d49-9247-4c39-a9d5-cfed8b276f7e", "value": "T122263302B7D1C1B1E4731A32976193A22A3C3C541B25CBEF63AD686CD9741D3DA3277A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710012012, "uuid": "aab4a631-90bf-4311-aa6c-ecaab4c461d2", "value": "75e9596d74d063246ba6f3ac7c5369a0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710012012, "uuid": "fd02f370-4b76-470f-a75a-02ec4caaf397", "value": "98304:2s+bOJ0sThJRnua26MlCvfUOUrRAHbPSXRuHL1rS7MMkFtULmM+Y:UbOJnbRuayo3BESTShurJFtZY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710012012, "uuid": "1c78488d-f6e0-4f2b-9684-30fc323d42a8", "value": 4435778, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710012012, "uuid": "3d9fbb12-7c6b-4c6a-add9-8fa6b8922e60", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710012012, "uuid": "7324ca63-657c-4884-a511-1ce5919f6236", "value": "61B0C139A4A8BCC92FE1CC2346B38CD1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54a5bd7a-de2f-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1710000536, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710000536, "uuid": "136cefdc-f5d5-4525-801e-c7db5e709b6c", "comment": "Malware payload (Mirai)", "value": "a5f8b534c8c3f32ae654bf8cb2fb68b1", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710000536, "uuid": "9615d68b-d774-4caf-b45f-4d4fa66cc434", "comment": "Malware payload (Mirai)", "value": "ee130d13367049640e5a3e810badca8db8960eaad5f85bf3e8ab02292e7f0f56", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710000536, "uuid": "f615f03c-b433-4058-bc5d-1c6633c4c94a", "comment": "Malware payload (Mirai)", "value": "5071307b740e88078cbde4caf1e8860952541424", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710000536, "uuid": "cc7c9608-e9f9-4029-aa2a-98fe3b82d9e0", "comment": "Malware payload (Mirai)", "value": "d4149b6c15ee02fdf8739e70c40b0d870f4a3e47610b4b38a9d4ba42f5cc088a4ff4577d3c3da9161e884383de85ea01", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710000536, "uuid": "6a8ef1b3-9d9c-4ff1-88e8-ab580e1dd17b", "value": "T1A3E31A56F8819B12D5C111BAFE1D128E37131B78E2DE7312AD246F747B8A87B0E3B905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710000536, "uuid": "2fd624e4-59f9-4a1e-aae9-79b814f38bb3", "value": "3072:0CKBUmbgWz4XFQ9sHwIaOOxGjBPCm3CR5RjL:0Copn4XG6Hha9q/3CR5R/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710000536, "uuid": "6ac80f1d-447c-4b21-84f8-49fd11a86183", "value": 143260, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710000536, "uuid": "026c1058-7249-4f64-8fb3-8324ac1c8489", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710000536, "uuid": "00df866e-f079-45c2-94bd-87ba8f1b2a96", "value": "vlxx.arm6-20240309-1608", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f9a60fb-ddf5-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709975697, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709975697, "uuid": "78944e42-c966-4113-bc50-f8f6702c59bd", "comment": "Malware payload", "value": "2f93812b85b76ca31819889ea0c36c93", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709975697, "uuid": "6d901072-5964-4572-b9e3-5a5973be34ea", "comment": "Malware payload", "value": "ee269c7ac7f924229b658bf54fb7d6ee42fd8b221b43e08fff08e99b6a6366e0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709975697, "uuid": "6bb935ea-d103-4c25-8f5a-f894a8d53fd6", "comment": "Malware payload", "value": "040b207216f697a42bda54a4d1e527d739c928f1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709975697, "uuid": "86c9b5f8-5e19-476f-a287-d524a1530064", "comment": "Malware payload", "value": "ee7cfad72e9c59fc651ce76592bec4628a9da8b54d9371a2c3ea8ae6094cdd6c9d9c8b3d9b311a15197fbb3f9c9eab58", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709975697, "uuid": "d1027d9c-3aee-4f6c-ac96-2c45c60012b6", "value": "T1F2E2D132E74268F3F6E10CB33A6AC6055396717CEE0375BBAC191378E4D30129AB18C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709975697, "uuid": "f29ff8cb-826b-4e47-9719-25ba0eaf6278", "value": "768:WQCEJ3Eda5gR/GVbBxkIsWdR9tZ8q1IvmRewPSh3W3UR:WQCGEE5EsbD9LfInoSh39", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709975697, "uuid": "6703eb81-1f7b-4b13-92c0-56c6180ea1b4", "value": 31760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709975697, "uuid": "e310c458-681b-413c-b7d0-2b7467842ae2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709975697, "uuid": "a3dc2237-373d-4ef3-976b-90e1882a2ea6", "value": "2f93812b85b76ca31819889ea0c36c93", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5972873a-de03-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1709981646, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709981646, "uuid": "9dc8ac7a-e177-40ff-b201-215ed104d4b5", "comment": "Malware payload (Mirai)", "value": "3d09f7c8cf61a3f94f8d60db6a8974d5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709981646, "uuid": "5d72646e-0831-4dd6-a54a-909607cd7c3b", "comment": "Malware payload (Mirai)", "value": "f114161cf9f2432e8f57b4b6c122a8691ed22789b543764cff55ec8f2eff3a76", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709981646, "uuid": "37202d38-cda7-4ac2-82ac-d76eafad835e", "comment": "Malware payload (Mirai)", "value": "2a485929ee37f9e36993e0f3174eaf7a9bf7f875", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709981646, "uuid": "4f67113b-7aef-4a58-9543-aeed059ea561", "comment": "Malware payload (Mirai)", "value": "020bcde7e6c1163b63be0e791073fad83d02cc5f6803b6abc78fddf517b75825f3b57c80ba7441a567ce91a11c5577ac", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709981646, "uuid": "06e21736-3ce0-4012-8508-8590d26be10d", "value": "T1A2D30945F8415F23C6D612BBFB5E428D3B2A17E8D2EE72039D256F20378B95B0D36942", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709981646, "uuid": "fe0b8f69-16b0-4a79-90a5-d18004b00929", "value": "1536:dPTk45W6gJXa0BZkARzPFuAewIP4VUNGqT+YYfAgHxGTUEF2ld0pwywAFG1lOW86:tTkesZkKzFui04MPaYYfAzwEzc5mj4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709981646, "uuid": "d65d730f-7223-426f-b87a-602ccba904a5", "value": 133888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709981646, "uuid": "6f3066c0-17ac-41f3-8038-7d89df96536f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709981646, "uuid": "c39f22e3-0df1-4690-a902-f4233b841230", "value": "3d09f7c8cf61a3f94f8d60db6a8974d5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4ecba5f-de0e-11ee-b7ea-42010a9c0006", "comment": "Malware payload (GCleaner)", "timestamp": 1709986631, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709986631, "uuid": "d269a9d8-f941-4799-a3e7-3d2ab3659be2", "comment": "Malware payload (GCleaner)", "value": "dcdb8927f6e675c229e9620c2b391b48", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709986631, "uuid": "5b826150-622d-47dd-b844-b89601e02b1c", "comment": "Malware payload (GCleaner)", "value": "f1a83ca51de663f90eddcee2480847538f36d6151306d4c31f9d5e8baf709a9b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709986631, "uuid": "7ae51c1a-fda3-4861-bb67-3bef44ec446d", "comment": "Malware payload (GCleaner)", "value": "a8a877dbd644e8efaaa6cec73597c60aa725fda9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709986631, "uuid": "00d0a4a0-51fa-428a-b3ae-29181db79f4d", "comment": "Malware payload (GCleaner)", "value": "42e82ddea3a937ef9560a8d543aa1820f33ddbcc1e62a2ee97f77f7ebe24d94c13a4fe260f4253ad5fd3e60e7441fb1b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709986631, "uuid": "4ec8132e-3486-4af6-a35b-af84112fd8bd", "value": "T1CC64E11179F0E432CAA796354871CA909B7FB9222926D60F7B25177F6E203E08F35367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709986631, "uuid": "9585a530-3f1a-4768-aad7-ce83030efb7d", "value": "06c8e00a743867b86720b098532e17b7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709986631, "uuid": "11d97571-3823-4bee-ba84-c6f1c2b87b90", "value": "6144:okBNJwDuCroWUZWz5l3+PsILtuJIqcDji6A1q:gD/UWMhLtuJINDu6A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709986631, "uuid": "26bf5b12-ed72-4c62-b0e9-9de5d75c4781", "value": 313344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709986631, "uuid": "a2ced3ea-146c-4029-989d-e64faec4da45", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709986631, "uuid": "3a125242-b05f-4e36-a42c-14aa8d810634", "value": "dcdb8927f6e675c229e9620c2b391b48.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee6effa0-ddf6-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1709976312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709976312, "uuid": "b83ba8b8-7e0e-4aa0-8786-b161cf4279f7", "comment": "Malware payload (Mirai)", "value": "efcde7c5dede378109b75f8f3001455c", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709976312, "uuid": "b06f763e-9dc6-446b-87da-63b9bcfce649", "comment": "Malware payload (Mirai)", "value": "f1b440aefabc4d925018c8df93038ee4ad39319cd4dcc46d7ba88b29b03977b1", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709976312, "uuid": "da8def59-12d4-416d-a455-0fc0b09dbd06", "comment": "Malware payload (Mirai)", "value": "c256d57e747fd958989e5c43e1402c4c69b364df", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709976312, "uuid": "7a8784a8-10dd-4653-b72a-1f3e9dcfeb76", "comment": "Malware payload (Mirai)", "value": "b003de94da386d187b3cd7c29014c4518fc711e74bc75c184dd764923f72f59a089a12a02f7eda40009c8260e8cc27fe", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709976312, "uuid": "07d325c4-40b5-4a84-8fa2-b61894834969", "value": "T1E7D30945F8415F23C6D612BBFB5E428D3B2A17E8D2EE72039D256F20378B95B0D36942", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709976312, "uuid": "88b6610b-28d8-46e2-9308-f423c0ac2bf9", "value": "1536:dPTk45W6gJXa0BZkAgzPFuAewIP4VUNGqT+YYfAgHxGTUEF2ld0pwywAFG1lOW8z:tTkesZkzzFui04MPaYYfAzwEzc5mjj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709976312, "uuid": "8896a43e-c431-4f25-a4e1-24a309830bfb", "value": 133888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709976312, "uuid": "48b8ccac-1ecc-459e-8bf3-ad0b5d3e23ae", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709976312, "uuid": "053b50a1-47b8-4a60-aba7-4d755df242c0", "value": "vlxx.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d363afe1-ddf1-11ee-b7ea-42010a9c0006", "comment": "Malware payload (GuLoader)", "timestamp": 1709974119, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709974119, "uuid": "f9cc88e1-2372-4037-8b1e-0d104093343e", "comment": "Malware payload (GuLoader)", "value": "c6f263150e59f127fe2424eae2c89eb1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709974119, "uuid": "4ac32faf-eecb-4e05-ada2-f1ff21b7cf1f", "comment": "Malware payload (GuLoader)", "value": "f22827cf995365d3de5a65698f7666f8379031ed63f117a6b803c46e6be1dc0f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709974119, "uuid": "4675a7f3-f31e-47c7-a8fa-a312f15eaea8", "comment": "Malware payload (GuLoader)", "value": "8a04bdcc542f935075c43bce3a4423b4f1914cd2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709974119, "uuid": "8c5a996b-a544-4478-8253-3deb3f30bf58", "comment": "Malware payload (GuLoader)", "value": "0f2d44a9485b8c415b04b1bf076cdef2f44e1e7eff14878c0d54a934443aaa651ceddf95a6d7211d48adf2668c3f2252", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709974119, "uuid": "7ddbc56d-7bc3-4b3f-b47f-3f670d7b98bd", "value": "T164D4010FB5429496EF6205378963AE74AF1F7E3875C2873243B07BBD19722948B3D219", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709974119, "uuid": "5b07179b-c207-4cf3-8641-b08ad0564400", "value": "e2a592076b17ef8bfb48b7e03965a3fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709974119, "uuid": "6b5a3def-df70-4bf0-a651-2e0e3ec49192", "value": "12288:T4mjiqrwQEI1QQWJadfHi6Dq1J9uCuk9ELRVOwPm2Mc/F:jTfEI1xWgdfHLe1J9uCuk6LRVO/2Mct", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709974119, "uuid": "3484bfda-99a8-4baa-ab1d-6bdd9c0e00b3", "value": 640104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709974119, "uuid": "c46cb2a9-82d2-4917-8a85-aed5b6810815", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709974119, "uuid": "f7d85e9a-196b-4d97-850c-a7e655a47175", "value": "Retorikker.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffb3753a-de37-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1710004258, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710004258, "uuid": "1f7f2335-078b-4ae3-98d9-a31acbad681c", "comment": "Malware payload (Mirai)", "value": "9a3666043c0bf4445d1ca58bbd2a7ed7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710004258, "uuid": "6eb0e98b-a483-4ff4-8030-a7d77ab734e0", "comment": "Malware payload (Mirai)", "value": "f4c787ade73f59a29f78a91d9c8d6353a830d080e95e0df9953d6192e4835189", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710004258, "uuid": "c63fab93-8fa1-45ee-a958-eec18a34771a", "comment": "Malware payload (Mirai)", "value": "68808bf4bc1a833a87ae5d855d177c6c05a94922", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710004258, "uuid": "31c66e7a-e431-4291-88e3-e0a3266262a8", "comment": "Malware payload (Mirai)", "value": "c83ec967128c4978f8eec1defd3ad2ebef2d9379b07d9d38fedd22e2beda22bd891eaeeb7bdb5c2f9a080948ff4a7ec1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710004258, "uuid": "1a4040d6-be44-4f22-9a3e-ccf96db96f36", "value": "T181733A91FD829613C6D012BBFB5E418D372A13A8D3EE72079E256F20378785B0E77652", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710004258, "uuid": "e5c6ea1a-8469-47e0-b5ea-19e91cd67669", "value": "1536:8GcEk0+/kGoDTiKpLVrbwlONep5znoq5I6Si2:8GcSR7LVvsRn56", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710004258, "uuid": "a5184661-4682-4175-b2e0-c48088e8ac28", "value": 75268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710004258, "uuid": "af60642a-46de-4566-8bf9-ff514b1c748f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710004258, "uuid": "fe31d92c-5c81-4238-a5c0-6b2415cf2967", "value": "9a3666043c0bf4445d1ca58bbd2a7ed7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c839fef1-de31-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1710001588, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710001588, "uuid": "92045487-79ba-4406-805e-c1155bb753ca", "comment": "Malware payload", "value": "d94fcfd73566e4f2cab7b8aa8c56d37e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710001588, "uuid": "45f48aa4-45c2-4c98-9ce6-67bd645faf6e", "comment": "Malware payload", "value": "f581959276be5e36eca890309640bb077f289508b6dcd344d68f9ea1b9d1ce5a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710001588, "uuid": "8155bbdb-14e0-444d-bfeb-0136b9d2b7f1", "comment": "Malware payload", "value": "74f65b31a7d877c427241a09b2f607083ff12b56", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710001588, "uuid": "2281fff4-d7f1-450e-959f-519a8be1def1", "comment": "Malware payload", "value": "a8db151894e4ce1b8cab8c21739756bf5d9cd371d00b833de2b97cb84b27447d62544179c323c7a5aa3c24f49572ad67", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710001588, "uuid": "222c9206-d90d-498f-ab52-d30ab64c40a2", "value": "T1AFD33A5763A410A8E5B7E2BCDAB64A52E7B178050734D7CF1350813A0F63BE16E3EB61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710001588, "uuid": "87ad27d9-6b71-47ea-ad5b-396dea479ca0", "value": "619b4c5431d23b6cf0d35653e6de810f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710001588, "uuid": "b7203a7e-26ad-4b0a-a043-95bbb6c18f2d", "value": "3072:M6hsz9PWfKvreL/dB/kV9rbmJTQSaMm5/6s0G8E:M6+z9Prvre6YWl38E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710001588, "uuid": "8f93996b-1868-4a41-a166-3705c55b6ab9", "value": 138240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710001588, "uuid": "31a420d3-4e08-485b-bf48-da3467e0e896", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710001588, "uuid": "0e2ec708-7964-4e45-bf79-ab12468ef18d", "value": "SecuriteInfo.com.FileRepMalware.23452.27300", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c699079d-ddfc-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1709978822, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709978822, "uuid": "213a5ccf-670f-4f7a-aeb7-663f3f496ee8", "comment": "Malware payload (Mirai)", "value": "e1d7323d32dbe05c7f2c0282ed8283de", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709978822, "uuid": "6cdba97f-4cbc-4cff-88b2-6807a36f8cfe", "comment": "Malware payload (Mirai)", "value": "f59295ce13bec542873b4c3a8db79afa1fb2b27861251a702737418dbe3b9ed7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709978822, "uuid": "b413dea6-f72d-48ec-bb1b-8d49ca559550", "comment": "Malware payload (Mirai)", "value": "8f935bdee3db30f0055deb17e93d52afe5106db7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709978822, "uuid": "d1f3def1-dcab-4fe1-a6bb-fcbfaaba167b", "comment": "Malware payload (Mirai)", "value": "47c4b63b14c62c42cde50e40ad4682eb1e9a6bc3b8b6a91d9e63e6ffa5ef070663f62c15174cb63243570b0845ff9c26", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709978822, "uuid": "69729072-ba51-488c-a5ca-6be3ff7747bf", "value": "T1A9B35A73C8256F58C15AE1B4B0B18F792B63958182471FBE19B2C2B64483DDEF901BF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709978822, "uuid": "8425b473-be9a-403b-9af1-2ec2b549d613", "value": "1536:RaN/Y4/LqAge8m0McSFylwv206jz8/e5L076CaC7WCbo4lNXQUyIbCWlcHOV06fz:Rx4YegT+GxD2bbcHpCWPpRZojA8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709978822, "uuid": "b6cf8fe0-db0d-4308-9bdd-cf4953f182cd", "value": 117568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709978822, "uuid": "fbaec80f-1866-47e4-b4ed-ed3287c73b41", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709978822, "uuid": "444b2f2a-e4f3-4767-95ae-2875c7281d49", "value": "e1d7323d32dbe05c7f2c0282ed8283de", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "833e323b-ddfd-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1709979139, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709979139, "uuid": "6d72c1a9-d570-4ca7-ad8b-9e2ef7a2e9c4", "comment": "Malware payload (Mirai)", "value": "f057c29c813681a5678ff94b420165f5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709979139, "uuid": "ef4dbc41-8701-4235-a5e6-2df6917749b6", "comment": "Malware payload (Mirai)", "value": "f5db9bead03c5a5e75cbf9f7e143301a40b8dd053c2e612468eb69ff1a98e282", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709979139, "uuid": "691de792-5d76-4c29-b78c-17ab520bdc8c", "comment": "Malware payload (Mirai)", "value": "f479f37978856bafa6062a62db2648e4064587d0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709979139, "uuid": "2f18a7e3-52b5-48f7-85d7-82c091d7ee37", "comment": "Malware payload (Mirai)", "value": "201d43e7643bf5f64a74afaea1fd47ee541cf159e611a332b55b9ec1e7a95ab80b3d98a2c2002d99c36f6bfc9e4603fc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709979139, "uuid": "030cf3b2-f73c-486a-a70a-8e62470bdc65", "value": "T1F5937DC5F243D0F5EC8705B15137AF375B33E0B91029EA43D3696972ECA1911EA16BAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709979139, "uuid": "7814c9cc-a553-442c-b3cb-4d1da6204b0f", "value": "1536:sUYl80AvyebhzEzASUL39IaJi7M3MX1+NgKVL4GRUS3tkDNf7:sUYq0ovNHSQ39IPI21HKVEeBMx7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709979139, "uuid": "487b159e-f44d-47f6-9637-0deefccecb9b", "value": 89672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709979139, "uuid": "8132ecfd-a00b-46a6-9585-5896b2703ebb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709979139, "uuid": "7d920296-9e56-4bbd-ab1e-4be195d7cf49", "value": "f057c29c813681a5678ff94b420165f5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b136ffb4-de37-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1710004127, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710004127, "uuid": "460910b6-a2f9-4727-b755-9912b5155147", "comment": "Malware payload (Mirai)", "value": "27abcb6e6c96367c1e5e5ea38eb12cba", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710004127, "uuid": "6a447bc2-d657-40d7-ac98-e3d5caebecbd", "comment": "Malware payload (Mirai)", "value": "f820920cf2f1d667e02df6675023ee05131f70d0197288550715153f5c23df6c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710004127, "uuid": "e1552ac3-d273-4fd1-99cd-376140afaa53", "comment": "Malware payload (Mirai)", "value": "38c3da1089439db6f71e4519cc8556c130e669c6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710004127, "uuid": "03b36767-0408-4a77-a8a6-9f2d161c90e1", "comment": "Malware payload (Mirai)", "value": "2558db127eebd41ecd1868ee6b323896f7787d1591b55a704fc3eccd66ebe86916cc2234fee47bd22a4d93a09ba8e1e6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710004127, "uuid": "976d9549-ace3-4676-aeec-4d31c0b246c0", "value": "T100233A41365C0E47D1A25AF4293F27E083FEE9A020F4F588260F9B868675F77518AEDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710004127, "uuid": "35758cbc-7abc-401a-80ef-0ead5b7dd4a2", "value": "768:BUXIvf3MoLmX7TL7xETf2gDVnRokwVWEFPs12n+SG6RCQqO0uXttABU0s5W7NEB:1f8oLLKgDFSWEFPs1Y7GEtMpvs07M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710004127, "uuid": "180e317b-f1bb-477e-9703-1a2766c9feba", "value": 50092, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710004127, "uuid": "ae8decb9-43a4-4154-953b-c22c8f1cca72", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710004127, "uuid": "c69fa7a4-8bda-4cd3-bc0d-125ef14a73a9", "value": "27abcb6e6c96367c1e5e5ea38eb12cba", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d784012-de36-11ee-b7ea-42010a9c0006", "comment": "Malware payload (MooBot)", "timestamp": 1710003557, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710003557, "uuid": "efd9c8f6-b9b5-4d22-b332-45c88d2b5a42", "comment": "Malware payload (MooBot)", "value": "6b14e4d6b1699ca12f3494ab29055f6a", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "Moobot", "colour": "#FCD400", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710003557, "uuid": "cc30377a-cc7d-433b-940e-89500a61d9f2", "comment": "Malware payload (MooBot)", "value": "fb9792066637d69efe64a5b65db633551714d1357b79c4243bb443637d59fd86", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "Moobot", "colour": "#FCD400", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710003557, "uuid": "0610ae47-9018-4e85-ad5a-ecc2831b7886", "comment": "Malware payload (MooBot)", "value": "d21678bafac13f30696b93db0f2d567dcb173c99", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "Moobot", "colour": "#FCD400", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710003557, "uuid": "45022399-2532-4eec-9310-45227938be9a", "comment": "Malware payload (MooBot)", "value": "28c4d784e593569044e0700c21001a637d668f834266a264fafb3b69f15c1c6150118f8a5a00ffadab74c01325dd8033", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "Moobot", "colour": "#FCD400", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710003557, "uuid": "6700921d-086a-4298-99a8-48794204ed66", "value": "T1ABE30A56F8819B12D5C111BAFE1D128E37131B78E2DE7312AD246F747B8A87B0E3B905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710003557, "uuid": "ae73d839-821b-4446-8f87-c9a221145c51", "value": "3072:0CK4UmbgWz4XFQ9YHwEaXrxqjBPCm3C95RjY:0CBpn4XGWHFaNW/3C95RE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710003557, "uuid": "eddd7077-d8ef-4d06-ab0c-568ac4d4496c", "value": 143260, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710003557, "uuid": "ebcce7a3-7682-40a6-986d-70186609e78d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710003557, "uuid": "3afd1582-91a5-4b29-9157-2e7958bd4f71", "value": "vlxx.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "099a2391-de38-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1710004275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710004275, "uuid": "a286521f-2818-40fa-8109-fb6f8c6903be", "comment": "Malware payload (Mirai)", "value": "dc95ca386f994e1c73bdb76c352d0f2d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710004275, "uuid": "3871f4fb-c086-4ab0-952a-73e2fc64c880", "comment": "Malware payload (Mirai)", "value": "fba72b5e327113938e2b920f5b0f60c0404c62ebab66c3ad77f9da5df76fa799", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710004275, "uuid": "8673a6fe-9c17-448d-ac9e-4af23274d082", "comment": "Malware payload (Mirai)", "value": "06d7a3facae580476815b85a299ea2ee49b174b4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710004275, "uuid": "12482e38-f50a-4766-9a89-70cd98169ea8", "comment": "Malware payload (Mirai)", "value": "df4b6e56bc6ce98540f32b7fe91d9fcd97ca7e2f74e05b45d50d094a2623479ab7a9c3ad71fa3816e2a4c1b50c71c215", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710004275, "uuid": "cf800b0f-fea9-4c8d-8e2b-90cee5137973", "value": "T1D1731A45B8818A16C5D813FBFD2E018D332667F8E2DF7212DD105F6477CA92B0E67A52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710004275, "uuid": "da3703aa-22ee-46ec-b1ad-58280a3fcb18", "value": "1536:eNn8UxkW50thqBtIC1R4/LsdH0ZBYSSZvNNSVzfpnDM4ioyuuz6xd42+:wxkW0hCtIUOSqzgjMbyuuz6r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710004275, "uuid": "5ed91092-5348-4c6a-97c3-e1a14a19be61", "value": 75056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710004275, "uuid": "68f65441-527d-4115-ac47-c4c4f8d1bd20", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710004275, "uuid": "2a6f2d45-0e8e-4dba-9e92-59c91de54b35", "value": "dc95ca386f994e1c73bdb76c352d0f2d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9c18a08-ddb3-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709947474, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709947474, "uuid": "d89c8497-f9e8-4e42-b361-e66852b2891c", "comment": "Malware payload", "value": "464334735cb66b97fcaa22fbde9df6d2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709947474, "uuid": "dc467a55-278f-454b-8199-9d9686d42520", "comment": "Malware payload", "value": "fcc1937242d48ac301980448f2268d9b345c34b4d0dfd158eb39e1af47ed0c1b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709947474, "uuid": "94db1ef2-88d2-4bb5-ba6f-8561af1315ba", "comment": "Malware payload", "value": "8a3dc0ab86fbe0e23a2abdccf21372ecf945c9a1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709947474, "uuid": "0922f69c-1c13-45fc-97a1-a63c08268961", "comment": "Malware payload", "value": "5bbecef99bc2eea96817d10380afb9b54a42f01f40b1b2bf28cd8b9d8c210a238a24a348abe08e2fb66bc93cc4a17f64", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709947474, "uuid": "f0c47f1b-768b-4b90-a619-c2ce0f306d71", "value": "T10FC34C20B5862178D0A469B8DA3B14A3F7B17C58677193FB15E508D83E9B7C89F3DB02", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709947474, "uuid": "68781bc4-bf81-4acb-9e5e-7fc7d6db7c8c", "value": "45268fa37ada66eb796ae9d2556410f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709947474, "uuid": "2dba53cf-ae64-4f64-8056-ce969b852330", "value": "1536:HZPFuxU77974E2vXOOiatgHQYQBMQ0IRXQdhN/jqss2loHuU:hFuxm4TvXODtIRgd7HoHv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709947474, "uuid": "034c6346-b7d3-4a8e-bd1c-6e1698e46be0", "value": 119808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709947474, "uuid": "b02ebee1-21d6-4e42-982a-557a25737df2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709947474, "uuid": "fd787a75-37d7-416c-b066-b3129ba19247", "value": "SecuriteInfo.com.Variant.Lazy.474957.4861.25499", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfa41f12-ddf1-11ee-b7ea-42010a9c0006", "comment": "Malware payload (GuLoader)", "timestamp": 1709974113, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709974113, "uuid": "0f6713b1-b3f7-4ae7-95a7-7550cfcbf7fc", "comment": "Malware payload (GuLoader)", "value": "bac063bc7a0748124ebc8e50e47fb6f2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709974113, "uuid": "3d90c010-68a8-4f42-aa08-8cc30a781eab", "comment": "Malware payload (GuLoader)", "value": "fe23c0c287270b2d1867d2d95efd2864c7d31a069e74b77f5aa8a1894f4e598b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709974113, "uuid": "5903bdac-78d9-487b-860b-d29ba85aa7e5", "comment": "Malware payload (GuLoader)", "value": "473bf34e2db6c37d7c300d7260ca3187aca65018", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709974113, "uuid": "0c2e3f59-2d57-4620-be04-04789b15588f", "comment": "Malware payload (GuLoader)", "value": "d76d5f203702c93261955cc9ecdcdec79aa28ae5cd8507e7dbf5fc2360bb6e6b5274cbcc8ad71584a5da992df15cf19d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709974113, "uuid": "dcf7cddc-f870-4a70-973a-cc58ecb0ce02", "value": "T1F2D4F14EA54154DAEF610137C5A3AE74AF2F6E3CB5C1477213B43BBC18322959F2E21A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709974113, "uuid": "9fbbf556-577a-449c-b239-343ded8d3fb5", "value": "e2a592076b17ef8bfb48b7e03965a3fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709974113, "uuid": "7d292cb9-861c-41bd-8017-efad23846a31", "value": "12288:R4mjiqrwQmOFQRTfy65TZNR34pEEoCsj9ELRVOw/qsENsMc/NE:RTfmE0Ta65TZf34pEEoCE6LRVOy0sMcm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709974113, "uuid": "6a98c424-8060-42c8-8cfb-1944b4037020", "value": 608592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709974113, "uuid": "728a714c-ac2e-4870-9b57-89f11b4d6b08", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709974113, "uuid": "1e9b2ee1-81b2-497c-a4ac-3d6d740968a7", "value": "Lokalplanlgningen.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d6c13a9-de03-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1709981652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709981652, "uuid": "237961e4-b4e5-41a7-b7df-fa11d94342c3", "comment": "Malware payload (Mirai)", "value": "a99b607776a2fa53c2442ce4c68dfc91", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709981652, "uuid": "0703adc9-e0f2-4b19-930a-0e242a891ed0", "comment": "Malware payload (Mirai)", "value": "ff1447a0e25c2756470f50e8f42a33a7c064cea26c89c69d48c80b9dea8ef200", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709981652, "uuid": "25b34f77-bf44-4ce6-b2a8-7a7bd46a2874", "comment": "Malware payload (Mirai)", "value": "ed8d135ce6f2cdb026b56f375aa931e472193d75", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709981652, "uuid": "70e87483-2fd3-451c-b4ec-b5c8adbda3da", "comment": "Malware payload (Mirai)", "value": "5c6cf37844a7b399d89ad5f9fb52b25264fc50505e56b98f837f28629f9c1035e028874e87746dc06eebae9be72d0d5a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709981652, "uuid": "587db694-27c4-4d0b-ac52-eff45ff8f23c", "value": "T1CCD32A05B30C0A47D2632EF43A3F67E093EFDAC121E4F640256FAA8A9172D365585EDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709981652, "uuid": "b972691d-ed28-4d33-a75c-a52c414ea5df", "value": "1536:6ApYWLEkcvb5IMPz+z1kyxgxpzvTLLNsoghM8gzLPMvgvAVIRc732d3qSC5Kgkma:u5Pzakyxgx97fR8gnPMNVcm7jjB0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709981652, "uuid": "94e6d2ed-a0cb-4c63-8926-85f01de6b4bb", "value": 132344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709981652, "uuid": "9d21670b-0f85-451d-b2ef-d0d75551a602", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709981652, "uuid": "04520ef7-3d1c-4c75-bab9-ee810ec1573d", "value": "a99b607776a2fa53c2442ce4c68dfc91", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4e80c95-de38-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1710004616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710004616, "uuid": "1225dacb-698b-468e-aa79-a2085c8e00d7", "comment": "Malware payload (Mirai)", "value": "65b4f2ff78aed9922ee3d66a15cf94bb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710004616, "uuid": "7da05df1-4045-4ab3-805b-f65d603e5321", "comment": "Malware payload (Mirai)", "value": "ff901f8b04b16c76b520837c0e1d46253b6b6e0e69ee169f2bdc99f5c271ba60", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710004616, "uuid": "08b07dfc-4299-4271-bea5-c13d028d0674", "comment": "Malware payload (Mirai)", "value": "2b9728c121471e7b1d1b9035463347771ee88648", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710004616, "uuid": "174aa86f-ee48-4e7a-915a-eb596c85303a", "comment": "Malware payload (Mirai)", "value": "80db95745f2b7cefe7a87eeaacc7d9dd6652085bd972d340b25cdd193af084239ac4959c5f7747b190726bfb9c151513", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710004616, "uuid": "7f10cf8b-de9a-48eb-9abf-5fdcf6fef47d", "value": "T1BB733B91B8815A13C6D452BBFB6F428D77261368E3EF3203DD25AF21378781B0E6B651", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710004616, "uuid": "3704b40c-f98a-4b0d-8646-90cd28d67018", "value": "1536:zwvX0cVK04vZz1A6vn/TDIEb99OwlO5FaD2g2KSP6dltRiSi2:zwvnSBbDIOCLpg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710004616, "uuid": "6d15c015-ffef-41da-9a48-3bfcd05b8e20", "value": 77648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710004616, "uuid": "d78cf510-946e-4cae-b606-c9478826251a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710004616, "uuid": "66c7c0fa-177f-40d6-b5a7-089d613789c1", "value": "65b4f2ff78aed9922ee3d66a15cf94bb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }