{ "Event": { "published": true, "date": "2024-02-02", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2024-02-02", "timestamp": 1706918581, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "4ab29c91-fc5c-486a-ad2e-f8ebd752d53d", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c474e23b-c1b3-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1706868833, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706868833, "uuid": "9ddb13b1-0323-4366-8ce5-aa069af7c6da", "comment": "Malware payload (Mirai)", "value": "3340f7500f043a2eb02c4c85936e4e4f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706868833, "uuid": "6dcef721-3e46-400b-b0a7-d293b89681ee", "comment": "Malware payload (Mirai)", "value": "00e7924d536ee1e573b8a94373ed31fdaeeb5af7c903663c8197a500ed28e1a2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706868833, "uuid": "ce1898a8-114d-489b-82c6-14fc5120f685", "comment": "Malware payload (Mirai)", "value": "fcf26a0ced6a55ee5e83f5a9076ff5e6ea3242fe", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706868833, "uuid": "3c8d3e02-9146-4386-b0d9-83605678ab41", "comment": "Malware payload (Mirai)", "value": "7f12ef99e1070c1cc93f58472d7d5daca73658e6509df6c69a4e930d016afc54a48866f640e692da692b645682d38996", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706868833, "uuid": "eb129882-2c71-43b0-ada4-b0003adf0c4c", "value": "T14453C85E6E618FECF7ACC33447B799216359338633E09689E29CD6105F6024D681FBE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706868833, "uuid": "cf44e49a-fd7c-4d81-b6ed-fdc5311b6929", "value": "1536:lq5RThRNhRhR/RuhRF25t0tQ0oaeHkncHnK:0tCQ0ouncq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706868833, "uuid": "b44381cf-ab4d-4b72-903b-da1e694f03c4", "value": 61292, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706868833, "uuid": "82df82e0-0bc1-4ed7-bc39-1aad14f1c7da", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706868833, "uuid": "f1e4c236-7e30-4240-b199-1599c5fc719c", "value": "3340f7500f043a2eb02c4c85936e4e4f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e47e570-c1b4-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1706869091, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706869091, "uuid": "ae131fd3-a172-440c-9a31-5bf3d709f2e7", "comment": "Malware payload (Formbook)", "value": "e8507b651098c60f782713d89592b0bb", "object_relation": "md5", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706869091, "uuid": "962431ab-4d78-435e-88c8-31ca7547564b", "comment": "Malware payload (Formbook)", "value": "038d0ee833348e46fbf0a8d441e083eff03f417f919bdff5938442a9123e675c", "object_relation": "sha256", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706869091, "uuid": "32ad5ff6-9866-4b1c-9fb7-53736b4ca349", "comment": "Malware payload (Formbook)", "value": "42551e75a25331927c31a5506011ac312a359ac4", "object_relation": "sha1", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706869091, "uuid": "445970dd-52ac-45d4-92ab-770a59ef4890", "comment": "Malware payload (Formbook)", "value": "f9512424c5457b9c06633a591895b0547c3ea006240ca2bae5520bf1e02e15848cd20bf0620001efc393c51fbe5b1dbd", "object_relation": "sha3-384", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706869091, "uuid": "315f62f6-e6da-49b4-9ad2-7a1408edf3f9", "value": "T109340225B5D8E0A8D451B5360DE8D2E78101FC74DECAE85F3458BB2E2AB288147337DB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706869091, "uuid": "7824d750-9da5-4d91-9ef2-4a6fd2a35c09", "value": "6144:BTXunlZP8VNWX+YRCZ4qd6cUgDBELDMWlHirx86u/:BTiz8VcX+YRw4LcXO0+Hia", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706869091, "uuid": "a99e9a17-55a9-4bab-ab37-460e190de36c", "value": 235520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706869091, "uuid": "6c1e4d7b-d1f1-47b9-8ee3-e1d7ad3ae945", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706869091, "uuid": "a1f3d34f-f2f1-4343-92a9-62f81fea2690", "value": "AL5052H32.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "088ecea8-c19a-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706857780, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706857780, "uuid": "890ba5d2-973a-49d7-bd18-f78a580ace4e", "comment": "Malware payload", "value": "ab6227e95fb81e77ccbda8588d4a8a7c", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706857780, "uuid": "33360fcb-87d0-4de5-9bd8-959c88376c3f", "comment": "Malware payload", "value": "03ef27430710dd7a3bd20403bfb82d2737e1f168f87261832be690a167250e92", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706857780, "uuid": "75319519-e8ca-41a9-9967-7395cbfddbfb", "comment": "Malware payload", "value": "bbd2de3e52d849a8d34a2891c56676040a9fc65c", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706857780, "uuid": "90e5d2c6-653d-4269-828d-4305e61c8a4c", "comment": "Malware payload", "value": "252c1c1715e81b0ec83c49ecbe0fd6969985f17068a05135e3e8c03e2b838585575fffefd699b23682dcb604b51d5061", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706857780, "uuid": "1ff86fe6-417e-4285-8249-e2176ce9b06a", "value": "T198548D332853C613C323CDBB474BD606967C456DB680C9804947B97FB73B7EA9E42A29", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706857780, "uuid": "3f962e34-7bf2-42d2-84e7-5a41662a9b08", "value": "3072:DWiPXpyqgSy3EXPJNq+XcsGwlItdjjjn6jYiYzoAs+Utdw8d:LYqgSy3EXPJc+ZGKcdjjj0te8d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706857780, "uuid": "234a92ea-7059-4358-8fb9-37ea7cf0244c", "value": 301478, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706857780, "uuid": "f43a77d7-1e11-4ef9-bf25-86f67758419c", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706857780, "uuid": "96b73034-be93-410d-bf8f-2ddf650bbcdb", "value": "COMMON WEALTH BUILDING Report.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b586ef94-c1b4-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706869237, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706869237, "uuid": "e737ab19-fc0a-4dec-97e0-f3a908e5cced", "comment": "Malware payload", "value": "3857ee86cf3715ba060641cbc57cc9e9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706869237, "uuid": "e74f7887-2d43-4a59-b3ad-526f625dafdb", "comment": "Malware payload", "value": "04ce9f64eb4cbdc7e9daa3fc7ed41a88ce1644ea124cea019da622b5cdca5638", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706869237, "uuid": "95482443-380f-42ee-beff-2c1360a0344c", "comment": "Malware payload", "value": "f13a933f45bd9a0cc4372311e2f1eb4b384ca467", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706869237, "uuid": "1464ca87-0f87-44d7-a2e2-3f9de8edd9ce", "comment": "Malware payload", "value": "14a331a95a72d0bd1a9e60552b9d105b2ee9ee213649bf6aebfdef0db55ef1dd3241be51a296842089167409bd6427e0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706869237, "uuid": "07589b5e-ecf3-4946-867f-6bfe910666e6", "value": "T1E5A3F582BB43DFB3E45311F142F79B324A31FC3E4C22D981E769BCA59A515C0E61A768", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706869237, "uuid": "d61af133-6b20-407c-878f-53180696cba7", "value": "1536:NFr6fpt2ZS40Rr9XXKjg0dBet8deBSMncw4FR2L:NFrSJ5R5XXQg0GLIMnc/D2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706869237, "uuid": "22d08dbe-9128-4eb2-9fb8-d2e3f7736227", "value": 101688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706869237, "uuid": "3bca6317-0e8f-4ae9-9dcd-164f94e1bbf1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706869237, "uuid": "ee95ed3f-6922-45e3-bc2a-1e1281ea27fb", "value": "3857ee86cf3715ba060641cbc57cc9e9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f61ae3b2-c1b3-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706868916, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706868916, "uuid": "912a201a-89d7-46f2-b80e-efd0a7514c17", "comment": "Malware payload", "value": "278bf71ab307e42ab0d46a008d61e996", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706868916, "uuid": "843c227d-fb35-4d3b-a5f2-583793b80235", "comment": "Malware payload", "value": "054b7fe6c3951e29a0aebef453eef92d5697796f92059fade5e5f0c7c0bac553", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706868916, "uuid": "58aac48f-e356-47c3-8962-1d22a973d533", "comment": "Malware payload", "value": "7cd1b6dca708609d51c0f0e32dea3e8ff0cf3173", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706868916, "uuid": "80e4dcc7-df1e-443e-9d0e-d78f382a8453", "comment": "Malware payload", "value": "17d80e3296cee0cbfb9cba2fa309da5f6da480c72f389bc4d13e53181fe905afa8f501f6902511b4fc72ec9cc324367b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706868916, "uuid": "154ac6cf-87a5-4c77-9b6e-9a4cbe6bdffb", "value": "T18CC30763ED26AF4AC056A0F0A1F28F741B53BD264D570EBEA476EAE44143DCCB2453B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706868916, "uuid": "b1dbf4a3-ad38-47ab-85a7-a13d91d6c49b", "value": "1536:3GFEcNvzm8A8XEPCEN8Kpgyh78CDlHQVfWz+xf2QWEA72kwQ6:2qcVM8UP7NjppxQVfM+EQWnrwJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706868916, "uuid": "37c1b8c7-6da1-43cf-9877-cafa2b134906", "value": 122620, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706868916, "uuid": "c3ec101f-40bd-4361-91c6-7e01ccd0de86", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706868916, "uuid": "2c340cff-02e1-48e4-9ba3-d4dff0387bec", "value": "278bf71ab307e42ab0d46a008d61e996", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4921612-c1f2-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Amadey)", "timestamp": 1706895918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706895918, "uuid": "4182b959-5408-454c-a4d9-2ae157486bc7", "comment": "Malware payload (Amadey)", "value": "f11f68b2459ec251f08a81ec3edb06b7", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706895918, "uuid": "2d241842-1e40-41d2-b417-08ea7acb2e80", "comment": "Malware payload (Amadey)", "value": "05e4b6eaa6b8740078a8bebd3eba2401c31aeba5bea3709677f7c7312c9fd3b4", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706895918, "uuid": "cf0b64d8-d4f6-46bc-9ead-c7f02ceea6a5", "comment": "Malware payload (Amadey)", "value": "6afd7a55aeaa502bfd49b1d066ed804b323b3448", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706895918, "uuid": "ee572190-fd46-4eda-9b0d-4b39df11bde9", "comment": "Malware payload (Amadey)", "value": "24dd6b5339be343fe2fcb76f8a03b3f93a7947e587dc75d4bdb7b7cfaeca4f790b24e58d38902bcb7e086a16db4f92bd", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706895918, "uuid": "b5111c65-ccc6-430f-87f0-734573d7ed99", "value": "T16EF4CF117295C031D47211318A76DBF69ABD7D20CFA645DF63C07E6EBE302C2AA31B66", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706895918, "uuid": "f565d81c-e31e-49a8-bb78-e2b00120c20d", "value": "2be91d836f543fdb7570b933847cfa54", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706895918, "uuid": "a1aeffa2-04a1-48a0-803a-0b3da509da70", "value": "12288:aVRFKe+BO357ITsfgeRrnsxvBqt2k5rPaCGBeK1lgGkOru9c6:aVRYeB3STsYUsJORVbGEK1hlruF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706895918, "uuid": "56a102d6-593d-4c68-ac60-cb66a9166b95", "value": 745440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706895918, "uuid": "c37a341a-66b3-4ad9-8470-7bdc2e6c36f0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706895918, "uuid": "47d73945-4e5a-4c1f-b6a8-f9739d86733b", "value": "f11f68b2459ec251f08a81ec3edb06b7.bin.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd173b40-c1e9-11ee-b7ea-42010a9c0006", "comment": "Malware payload (njrat)", "timestamp": 1706892013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706892013, "uuid": "c75c8537-f4d7-498e-8719-b124fc087437", "comment": "Malware payload (njrat)", "value": "b67d6151110ac0979c0571b5e3dbd006", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706892013, "uuid": "aceca690-5186-4058-8452-5c6cf9321564", "comment": "Malware payload (njrat)", "value": "078a724f9a334f242ec580a1d6ec0f19f567ec778190e9eae0e312e7ec7156f2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706892013, "uuid": "376f0d71-e6ce-4830-a5b0-32c875cfa33c", "comment": "Malware payload (njrat)", "value": "5fe5b9cff780884fd793e206c78984c4b20df55c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706892013, "uuid": "171f4005-2540-4cfb-9a72-f88063eb17c9", "comment": "Malware payload (njrat)", "value": "03673d99031a4f1bca9491af2599f11922f158c0a11248cf50bc53e3bba9a7d29ea425b7080f63a1d2f7e8e32d11fe16", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706892013, "uuid": "9fe1b9a7-dcaf-4bbb-9edf-6d69b0771a50", "value": "T1B48503866254439FE827533B4CAE401C2AF17CC52EA3AECF2F18399A5E313C595DED16", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706892013, "uuid": "25d0e302-64d7-4576-b852-6955637ba803", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706892013, "uuid": "6f3291d1-2714-4e34-bfa2-84b9c293fc3d", "value": "24576:hQ0KBhk45t2KJV8jIyqkbgFqgUQX6cQL+qdFc+AhkrZ+oGrnFJStbI87XZU0w0PT:OtkNSV80y3gUcQdFBEqhmwtkgXYl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706892013, "uuid": "670c4087-d32a-4d63-8a1e-9d174fe1ec16", "value": 1859584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706892013, "uuid": "f4ec4573-6d22-43c0-add1-953f3f1e1014", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706892013, "uuid": "59e7763a-45e1-42b0-a57d-3a0cb92b0936", "value": "078A724F9A334F242EC580A1D6EC0F19F567EC778190E.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "964b7c50-c163-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Stealc)", "timestamp": 1706834396, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706834396, "uuid": "1ea96e09-a2ec-4241-9842-46e0265a7604", "comment": "Malware payload (Stealc)", "value": "e63e2ae27716a6446d369cd079b7235b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706834396, "uuid": "e3ad5d8f-9f34-41e4-a63a-da6ab7cd5d28", "comment": "Malware payload (Stealc)", "value": "07b3c4a47ec2b0e62681dd4de6866b809a82262c45360b24a19e47b2b17ed5c9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706834396, "uuid": "070dad26-54c8-4876-b6a0-784066018b49", "comment": "Malware payload (Stealc)", "value": "faa802e34c36ece2fb43d3f11dc0de52d85c2437", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706834396, "uuid": "5dc2a521-fc7c-4bf5-b450-bdb12a8c78ee", "comment": "Malware payload (Stealc)", "value": "aec816505bdf538c3b5bc7819c3e4d554ef5c6341f24422951d361bee9d2bea06341b11ae572bf4a7127b8cf65ce0219", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706834396, "uuid": "c1784409-5ffb-4696-a65e-60291bb81449", "value": "T1BD34CF1079E2D7F3C9A700707870DAA42E7B7CAE56B4809F37982B5F1E7D6904A66313", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706834396, "uuid": "9bb0dea1-4899-49bb-8fd7-a783507dccc0", "value": "81e86234e08eee20f287d99d24a311b6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706834396, "uuid": "534c0450-db3f-4e4d-b09b-3c30e57c1bfe", "value": "3072:y2TsPLbrk5ydSfk8PFasc+6MkHElWWpjS2LnlrBZ5u1eX7ijV5aAosx6TVN5:OPLAy4kc8GLl5tS2Lnzr6m4CAos2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706834396, "uuid": "c9b6b43e-4e15-4bd2-80c9-6ac627f9ab7b", "value": 236032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706834396, "uuid": "d7c145f8-5e57-47b6-a198-cef4eeac638a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706834396, "uuid": "b9ab9a37-8b27-4271-912f-cf7bf7db7f3e", "value": "e63e2ae27716a6446d369cd079b7235b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8563bb3a-c16a-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Stealc)", "timestamp": 1706837374, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706837374, "uuid": "e4182c96-848c-43a1-bf83-63e76e9635be", "comment": "Malware payload (Stealc)", "value": "5221face19d30914a73520072c399bf7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706837374, "uuid": "b85ba19e-bb1c-4d59-9804-fc790e8e26a0", "comment": "Malware payload (Stealc)", "value": "090e8d8376224c845817f5d635bb8e6021d33c2960cb6c12c7acfb913eee9093", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706837374, "uuid": "e1dcfe7b-faff-4f0f-a47b-1c65f74353a5", "comment": "Malware payload (Stealc)", "value": "3db050ba0ba6d5d59b994d59751bd44b9face1af", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706837374, "uuid": "6c3e850a-71eb-4c4a-96a9-51e8aaeb7fc1", "comment": "Malware payload (Stealc)", "value": "2cb7fc2ee96fa031a899be54babcbc9a1a7358d2bce9f7f4b6523d53464486395d7a47289896f62c65f087ac5b35043d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706837374, "uuid": "d4c5df83-5e68-47e0-a160-8890f49ba3b6", "value": "T12C34CE61B9E1C772D6A704B088B19AF45EBB7CB657B4818F23782B6F29712C04A13717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706837374, "uuid": "97a8c377-8129-46b2-a953-68b3d05dec18", "value": "59289c5ac00d3148bc94c0c06aed753b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706837374, "uuid": "713b9071-db0f-49b3-ab50-5f1a16fbc0ec", "value": "3072:j3sL5Z9U9D4zu9wcn9TKST3KUZ1PEn9/RySJy0hzVX7qz5sMnex6TVN5:DsL7kD4KN5KA3Kd9/FJyeZZ2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706837374, "uuid": "ff95b407-b596-4a45-849f-211bd7b6261c", "value": 237568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706837374, "uuid": "b340207d-9d09-4e0a-bae7-694e2fc6dbc4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706837374, "uuid": "2e7f4115-8aeb-4ed9-b4bf-3db0b4bee179", "value": "5221face19d30914a73520072c399bf7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a75907b9-c1c8-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1706877804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706877804, "uuid": "37b8fe86-62af-43f6-80bd-184502992949", "comment": "Malware payload (Mirai)", "value": "a70cc36d2208c4e88002355e3207c203", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706877804, "uuid": "134f7c3e-eef8-401c-9aa3-66a58345ddeb", "comment": "Malware payload (Mirai)", "value": "09aa8ad3daacc37ef16d22e47865f23850538aef30fb9ee4084778c5a2b0e761", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706877804, "uuid": "53cdc60d-8cb7-4c60-bfb8-2193a6aef6b4", "comment": "Malware payload (Mirai)", "value": "7bb5ec27579f8b4a7f845c80148d92eff0813786", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706877804, "uuid": "0a520e0c-7907-4052-87c5-86d9e3a7c9cf", "comment": "Malware payload (Mirai)", "value": "4a0cd2aaaa14df0402d1b72d066ad8f22fa9c68439ddbb9872afdcb3b70095b08638d54f3ff2756b4744fdd453050ae2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706877804, "uuid": "c10399f9-a066-4da5-b181-4bc49a755f88", "value": "T13AC3E506AA429F01D5D731FAFB9F415833536FA8E3F97101ED206FA123C6ADB0B66512", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706877804, "uuid": "13e6ce37-09a4-45cb-bf1b-3c3f3fcf402c", "value": "3072:4xocj9wrI/N+PHn5TevfeaagSgSWHQtuAv7KL7i:MocjSsIH5TsWaagSgSWHQ0RL7i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706877804, "uuid": "ae957b93-1409-47b9-a0d0-cbae9ffecbec", "value": 119420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706877804, "uuid": "a18a9bea-18a2-4e40-b004-06adeb38a542", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706877804, "uuid": "adfc3ebe-0412-4eae-afed-145030e67aed", "value": "SecuriteInfo.com.Trojan.Linux.Mirai.15506.11134", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91a7a28a-c16b-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706837824, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706837824, "uuid": "823a64f3-1c29-4fe6-85b4-112a48784eda", "comment": "Malware payload", "value": "2b24726e8998b04283d84654f12d716c", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706837824, "uuid": "1d025a8c-fb5e-4150-9b9f-0348d9231ccd", "comment": "Malware payload", "value": "0b2b734a80c001af0b7a4cab8a817d0c696b40deef87c98f672071e901994917", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706837824, "uuid": "267ddc48-8a80-4270-8b38-4d260ed9e8a3", "comment": "Malware payload", "value": "75420ae77c4cf9cc5191d24ac0fc0ffb72a504f9", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706837824, "uuid": "21dee7d9-c8bd-4626-b4a9-e4d4618d92cc", "comment": "Malware payload", "value": "775da70c87f806f4637afde58b8d3987a57a5eda76d736044cfdc9d0aadfef7e65ba1c8437d8809ca1aaf9595f31bc9b", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706837824, "uuid": "a1d71fb1-da63-4a4a-a17b-a2e86c071205", "value": "T17313D01B9524597FE43850B131EA38022908B676899014195FC27E7DB6FFB90293FB7F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706837824, "uuid": "a5a2f910-fb39-46a4-a503-6be92d64d773", "value": "768:YNbvbVkumWYEIkGs24tsOuha/whIdxYsmaGD2ULb0fla:YlDWW/IkGw5udCdtQLb09", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706837824, "uuid": "f8e6e34a-3531-415f-8b99-38676900ad33", "value": 45056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706837824, "uuid": "cf36f1eb-8e17-4a07-8e18-e8665671a595", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706837824, "uuid": "c21f496f-60d3-4e22-b4b5-ed5e7db31894", "value": "fcdf869bc179759c8be3093adec60b334d25cad63b78fd3d28229b0af88b765b_sc.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36e40e6c-c164-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1706834665, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706834665, "uuid": "574a1cee-1c6f-4b0c-9036-8bc153736db3", "comment": "Malware payload (Mirai)", "value": "909d95b17cfedd02b6c7ea714b7bfb86", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706834665, "uuid": "3afaea87-9b7a-4f83-a129-47b508d8f499", "comment": "Malware payload (Mirai)", "value": "0cca82a46060c09ba695dcddfa57c3e5c83adbe8a52c9ebbfc7fca879d7e4b84", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706834665, "uuid": "1b4f829f-07e8-4a24-9893-fe72b24a768b", "comment": "Malware payload (Mirai)", "value": "01209b9db9c5e37b723651f529d64391822ce1c6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706834665, "uuid": "79691a30-b55b-4232-9d34-c9086f57493a", "comment": "Malware payload (Mirai)", "value": "e652ff81d02d45acd10adace78506ef1f8b89fe1443a7d955ee3e1430281a9de7b57944c0afdce4d4a55a482f31554ef", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706834665, "uuid": "66fcf52c-b078-4f28-ae7d-4f98541eb8a7", "value": "T14943C652B8815A6BC1E423BBEA6E518D3371B3F8D1DB3616CC111B24778952F0EA7B81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706834665, "uuid": "10b092ec-2d8a-4d23-a464-d6fddb5f9b4c", "value": "1536:Jk48ZOlDxbcYfiQ125+XDW+rd8ea0ClG9WkQxNd42+:x8ZKut4DW+iea0OG9/Qh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706834665, "uuid": "44795c99-868a-4aad-beb1-7efbf7cad0de", "value": 55612, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706834665, "uuid": "9cf382bf-736b-4b71-9a8b-271ade995732", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706834665, "uuid": "81ba85c8-85ba-429a-a7e0-bee5554d3166", "value": "909d95b17cfedd02b6c7ea714b7bfb86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc54adad-c1ad-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1706866269, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706866269, "uuid": "b4907c37-070e-40b0-86c4-acbe0db7884f", "comment": "Malware payload (Mirai)", "value": "138f8b02cc55909a1709d52d14f0ac83", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706866269, "uuid": "1656b040-dee5-491f-af40-9b7b5c3809e2", "comment": "Malware payload (Mirai)", "value": "0cd18de7bd1534bc32134d1d9731b1426927486fd5a1746da18d226c47970667", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706866269, "uuid": "9ebe0af1-1a9e-4a6e-ab77-287484c75d3d", "comment": "Malware payload (Mirai)", "value": "45ace8b9eae2d8cd3b6e0d28e15af840fc05fe0c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706866269, "uuid": "7b7a39f5-cd83-437d-84d2-1f911bef1720", "comment": "Malware payload (Mirai)", "value": "5a04c196b6bbe5e63c70f54f0f827c6b99d1b13d5e562a3217c584828090772c3e82d20dff6cfa844830a8b829697a71", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706866269, "uuid": "1c88ee08-13e8-419b-9380-47a1131988e7", "value": "T189533921A9792A17C0E9F57B21F78324B2F5670E24A8C76E7D320F8EFF1854065076B6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706866269, "uuid": "0193d752-b5ce-42ce-beff-d7d6a4f6a6e4", "value": "768:47qtsAOUAoMq9reCYJr4ukj8J4JGCgY+dVU5mp5ouoKrSGO+h9sCF40:wqtsGAZSreC84Bj8J4JXgY+dVhuEhb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706866269, "uuid": "76bb1d2c-e962-4ba5-b09e-dca25ce28b49", "value": 62484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706866269, "uuid": "d0654c74-754e-475f-9f68-aebe542fe9bb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706866269, "uuid": "36e10e45-d11f-42f9-ac47-a23858beb6b6", "value": "138f8b02cc55909a1709d52d14f0ac83", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fcdcece-c1bf-11ee-b7ea-42010a9c0006", "comment": "Malware payload (GuLoader)", "timestamp": 1706873845, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706873845, "uuid": "39c90027-626d-46a0-a747-d60d741dacd3", "comment": "Malware payload (GuLoader)", "value": "7d58757e6c5ab52af59c69efd64ca5ea", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706873845, "uuid": "7f31f912-26d0-454f-9d0a-501b7103218b", "comment": "Malware payload (GuLoader)", "value": "0e59f0f8ea079c1f5f8a30238a4094caa001d116d8e014d5815c9866c0dc9236", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706873845, "uuid": "25bfb631-cf76-4fa0-8acb-56439dd53c5b", "comment": "Malware payload (GuLoader)", "value": "e14e8cb5c7e0f7ce87623b8b03dce6a7dbad3ccb", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706873845, "uuid": "76c2e0d7-0cea-4689-9132-d97446009411", "comment": "Malware payload (GuLoader)", "value": "03f434611a10ba43f5c5bf3c6212ca2d6c21c7c78e77cd683648f4ed672425f93f5ebc8bd20e166c583244fbc4b53ac8", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706873845, "uuid": "0ae17697-28b2-43f9-b677-1467ba103cfc", "value": "T10B452860972004BAF638953A24E06B355170FD2233F68A4F3E4E234D9F6E4E48F3448E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706873845, "uuid": "ed5547ee-6cdf-4a01-9b6a-f4c3aa1f1a74", "value": "96:53SVCfvfUE+cBA68HbogHln10ZDvnRgIiS9IVWeejKEq+adhXf+dgtDJn1x:gVU9Wbok0lgG9IVWUmg1f+mlJn1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706873845, "uuid": "a8869910-e5e7-4171-ba68-aa96c7c2cae2", "value": 1245184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706873845, "uuid": "ce04689e-69f8-493f-a4ad-75fc8711380d", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706873845, "uuid": "fee34cb6-3649-436b-8ed8-4cc3add435b5", "value": "screen_image.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d057f09a-c1db-11ee-b7ea-42010a9c0006", "comment": "Malware payload (IRATA)", "timestamp": 1706886033, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706886033, "uuid": "17bb6a04-16e3-437e-9dbc-9061750d0b11", "comment": "Malware payload (IRATA)", "value": "6b75d656c4bc46679e85fe0b2515951b", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706886033, "uuid": "d4ab3878-0b01-426e-bf13-c505c0796e2d", "comment": "Malware payload (IRATA)", "value": "0ed8987b07a4d017db6a475ff327eb6d9c6004ec5155a72635d3a4202a28839a", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706886033, "uuid": "3941dcf3-270d-411c-86fb-ff0d3444aec7", "comment": "Malware payload (IRATA)", "value": "d795ea1715152ce0381476725766ec76db4974c7", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706886033, "uuid": "18268b02-ad50-4146-a0ba-803476cb0b4c", "comment": "Malware payload (IRATA)", "value": "23961d9db2d21ed59dfb64d7ec0b035868b1188aeb9cf9f23bae50f0d653ac808adf8d59adef77c31a6f0e93e9dbfe1e", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706886033, "uuid": "1da50829-c2b3-4713-bb3a-b3d271073e53", "value": "T158D52343F735A927C8FAC3B225A42A3E153A0D28CB57B689391537FA74B79D84B841C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706886033, "uuid": "7eab8190-00ab-4199-80bf-58dbced2f7d3", "value": "49152:Q/odkkEeXP9acJSg2a41GOh7/ZS6yu3pXJY9cLyy0F8S/0KkuB/W8FIet9H9Ck8E:+0kkFXFZEg2/l7xlJY+Py8SDYeH0DI/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706886033, "uuid": "3ac1e1f2-541d-472a-9a45-3c9b4ea2bc9f", "value": 2982436, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706886033, "uuid": "02436ce0-fcce-4eac-abd4-377dbc307f37", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706886033, "uuid": "a683e49c-4ebc-4e4f-8a7d-caadaaaa6ffb", "value": "Application.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa37e4af-c1c8-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1706877808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706877808, "uuid": "108090c8-46f0-47cc-926b-1edea9238464", "comment": "Malware payload (Mirai)", "value": "59a05313ceff51e5d5b67f5401324a4c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706877808, "uuid": "68e286d6-6d59-4cab-b140-8bf1bb3ee4f4", "comment": "Malware payload (Mirai)", "value": "0eddb6cb5c34ca0e448e7365bb95ad7fa5dcd86868ef185183371a73cbabd000", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706877808, "uuid": "4264d7fb-7d8f-41be-8b08-659921522f31", "comment": "Malware payload (Mirai)", "value": "38d4f52dbca1b279570633792ab24d51f0c8aff1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706877808, "uuid": "6309f8bc-921b-4e69-a1c3-36135a1ccbbb", "comment": "Malware payload (Mirai)", "value": "ae39666223dff568fa97a3df8c4f860644f639937de3e8240a0ab51f10da3d7dd7555499b482269a6c8f5c3b20974754", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706877808, "uuid": "e30f990b-c413-44f5-946b-333c5c6aad3c", "value": "T1FDE3E907A9519F12C1C211F9FF5E425D37137F78E3E932029D24AFA0778A8EB0A7A516", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706877808, "uuid": "796279b8-ab62-4219-be22-59778495703c", "value": "3072:XfJuTgn5QmSr1tqC5Dka/dvloNs2YDoa:vJc6tytqC54aVh2YDoa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706877808, "uuid": "515204bb-a0d2-4938-98b2-f94d00cbd53b", "value": 147256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706877808, "uuid": "b20afec0-a8de-4842-9242-71f7f6e8b36b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706877808, "uuid": "7f5f60a4-9418-4d4e-b98d-3a10d30f63d8", "value": "SecuriteInfo.com.Trojan.Linux.Mirai.13429.5198", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f90e473d-c1b3-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1706868921, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706868921, "uuid": "d01f3ec7-fce5-4b95-8743-f598ba5b14ee", "comment": "Malware payload (Mirai)", "value": "e55aa2bb249682dbe87cc0dd48b1b5e3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706868921, "uuid": "8c4959d3-dfb7-4552-863f-47b4b6070d5d", "comment": "Malware payload (Mirai)", "value": "10691c26d2d890f3a0cde027a3a1c421210f0c2c0b8b626db500fd7ccb815e54", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706868921, "uuid": "da8e5068-a0ca-44c1-b5d1-157104b997be", "comment": "Malware payload (Mirai)", "value": "2599f3fc703acce21d87f5a2b3253d667757b4be", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706868921, "uuid": "6974a9f8-2adb-4f64-83e7-9b9c8649c021", "comment": "Malware payload (Mirai)", "value": "61f4071a3a5b692fa7563d9c321a731a2ad5837712c75958ae0b6d06f59514aecc1a0ea849c6bf113c390e98e063c8a7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706868921, "uuid": "4ca5a5ac-62dc-4fc7-8d07-a55e854bcd04", "value": "T121331841B8814A27C6D0137BB66E46CD3B2563E8E2DFB2179E225F50379682F0C77E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706868921, "uuid": "4aa41ab5-287c-4847-9d91-e99e73fd8cf7", "value": "768:mJkZrt4jAmAND9jkLEZtnEQT4lw7xCJPK4skuQEtwGl/HYmfz3ANJkw:mYrtz5D9qEP5f7x8ChaEGs4Q7S/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706868921, "uuid": "c9fd5d6c-bc6b-4bdb-a3c0-795cf8796650", "value": 50272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706868921, "uuid": "02653988-e33e-4502-a88a-681db4e9ca00", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706868921, "uuid": "469bba9a-dff9-40a6-88b8-e00d17aa28d1", "value": "e55aa2bb249682dbe87cc0dd48b1b5e3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cfff6d8-c20a-11ee-b7ea-42010a9c0006", "comment": "Malware payload (GCleaner)", "timestamp": 1706905945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706905945, "uuid": "c8d2eb0b-f4ea-44df-b2ed-d169e877d2ec", "comment": "Malware payload (GCleaner)", "value": "fa092cd96d9916f2e247067653cd1110", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706905945, "uuid": "41ba51e1-862f-47ed-86e0-692619a6cfd5", "comment": "Malware payload (GCleaner)", "value": "110c64b4a03a6ed6c8ffd2baba0a5831fd8bd59ca6b23d6e885a8f34e13461fc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706905945, "uuid": "aad5f307-7221-4d4e-9ce5-b76672634a27", "comment": "Malware payload (GCleaner)", "value": "b21b8b0914adc6d9c8a1d83e0ca0ddb83cd28d23", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706905945, "uuid": "ac6667df-ce72-4e8d-a0cc-6892b15aebe8", "comment": "Malware payload (GCleaner)", "value": "3e3f0785bddb7323094ae303b9801630221ca1e942f6f4322ea7a0409224ca670c2b48597a03ce34443f418ca7fe111b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706905945, "uuid": "e626f9d0-b57e-403c-9bde-a36676763ba1", "value": "T120045A1074D2C4B3D972153518F8DBB5897EF8350B619AFB67D80B3A0F302D29A35A7A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706905945, "uuid": "142f979f-b7d0-47b0-b9b1-6878319569c9", "value": "7995552d5727ea28793352af716fab7e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706905945, "uuid": "8e244366-3a34-4e05-9350-c02a0d9c15f9", "value": "3072:fjJNYb6cSN+tDbI3FUAiJtFej2TUgObqt/Y8O/tOAg0Fuj0thzIt3Za:fjJNYuR0Ifu9TxObNgAOSMZZa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706905945, "uuid": "537816fd-fe0d-4728-b3f8-357ce71448c9", "value": 180224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706905945, "uuid": "b3ba4689-e49b-472b-bae0-8e669ecd31d8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706905945, "uuid": "c38caeb8-7f7a-4587-b3ee-3cb28a32469f", "value": "fa092cd96d9916f2e247067653cd1110", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae4f746a-c172-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1706840878, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706840878, "uuid": "0afdc68b-1475-4b33-8c2e-1b3adab822b7", "comment": "Malware payload (AgentTesla)", "value": "e1b8ab8b159901379fd2461b8ba2614a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706840878, "uuid": "4f36a991-a158-4ffd-95c1-40efcd1abf6a", "comment": "Malware payload (AgentTesla)", "value": "114352a381c20bbe3de6bdf0a37b796dbd2858f1e1f83edd91364bc294db0ae8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706840878, "uuid": "4ae4a5b1-86bd-45e1-aab9-adb5a2783002", "comment": "Malware payload (AgentTesla)", "value": "495b9a1710d7c072838dd82f815d45f003ee3ff0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706840878, "uuid": "1c584ba6-bd4d-4b35-965a-180b6861c21a", "comment": "Malware payload (AgentTesla)", "value": "1e2f9f12faf7fb732f485955e34c648ee88fdea4333cc49d37c3f000e78303450ab2edca564380470e58ee36dab9bea3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706840878, "uuid": "ab3ee3d6-cbd3-4c51-8381-ad933ebd6fa6", "value": "T14945BF1273D5D166FEEBD1339F6CE11125F93D6C4067C21E22A81F356AF02A032ADA97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706840878, "uuid": "2c8d2dfd-112d-4427-aaca-0ad486c902a0", "value": "afcdf79be1557326c854b6e20cb900a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706840878, "uuid": "f4d34ade-1991-41aa-b2a1-e1597f4efbb5", "value": "24576:aAHnh+eWsN3skA4RV1Hom2KXMmHa3Veoh8jW0GYSYUH9k5:th+ZkldoPK8YaFOfdH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706840878, "uuid": "c3ee83bb-2735-40cb-b004-c2bd062043ac", "value": 1231872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706840878, "uuid": "04d5390a-6861-4ba1-9527-1dde19a19430", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706840878, "uuid": "6e698b65-70f3-49f5-9901-9cbb285ea43f", "value": "SecuriteInfo.com.Trojan.Locsyz.2.089.137.23316.16705", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2367b29c-c20a-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706905929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706905929, "uuid": "374acc2c-1a12-45af-ba11-ed156d07c9bc", "comment": "Malware payload", "value": "8a278116610042f4190575b1336a9bb9", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706905929, "uuid": "4c3ecbce-1a27-4fd7-a5d2-da01a4a97453", "comment": "Malware payload", "value": "1244239af6fc56ef269eeeafe07dd81df0a2ff7f97909a18172f63db7d459ef8", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706905929, "uuid": "22fb50c3-2f6c-426c-96b5-b70a054486cb", "comment": "Malware payload", "value": "8e0863b9cafa5b6dbddbb5875ca0a88f50defae7", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706905929, "uuid": "75ade372-c51d-45d4-a26d-a47f9fb49ed9", "comment": "Malware payload", "value": "02a58f6634e1f6eab153d4455a0f66e64bfd8324ab71434105757316841ba74421f09094d2d079afab58eec5fd31add1", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706905929, "uuid": "adf9dba0-3099-4ba4-be8a-783f06e2b701", "value": "T1B9824B980E3210A9250357F3D59E587CDC3825F7496288BA6E0DF2754C187AA7EBC9CF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706905929, "uuid": "14951ecd-6383-4e43-af0c-4800272147f4", "value": "384:FHLRj3h3JRjCvHh1QK5paGLvOlUiOiXskTv9ewtb6Qq:lLRzh3J8Pv5p9YzvMws", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706905929, "uuid": "6747ee9e-225a-4d3f-b36c-037da8c4dcc4", "value": 17683, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706905929, "uuid": "7912b2c7-323a-4349-9812-d2fc50980d44", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706905929, "uuid": "105c1f82-0dc1-4766-b52c-682fd406c432", "value": "UNIVERSITY OF DUBAI_Project_1-02-2024.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c3af11b-c1ad-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1706865947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706865947, "uuid": "8023e191-a425-413a-82f6-496b4ad1c766", "comment": "Malware payload (Mirai)", "value": "12dde44b4e3f650e4be8a94b5b6695a4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706865947, "uuid": "23a515cd-b838-4d1d-b108-a04c685bd9e2", "comment": "Malware payload (Mirai)", "value": "1441dc7a8314e7ff33d3b75d9480c77a84e4e7e09feec204c63c799e067adde1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706865947, "uuid": "30418a03-b6d6-4eb5-836f-282bcb543953", "comment": "Malware payload (Mirai)", "value": "1073283448eb8e0b4492e031b6141a5aae537c9c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706865947, "uuid": "a14c655f-3a44-4b87-8b41-c125a1799b69", "comment": "Malware payload (Mirai)", "value": "81dc8cfb2510c4550aad284cead0d03b64da7bde3cb49c0f61649dab0a63a51c2c9dbfd4c5a85330fb0f94bb75cb1b59", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706865947, "uuid": "d8f7593b-fabf-4126-9390-dc40c596230c", "value": "T1F4234B41765C0E47C2665AF4293F27E083FEE9A020F4F589260F8B868275F77118AEDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706865947, "uuid": "fbe81ef5-6f1f-432c-b412-e3d82c993927", "value": "768:9qkwvgVaz33B0bTGAX9PRskRpywFwyK7WhtdC5Ak2NtVABUks/5W7yvEx:aYVreAXV5ywFwyYyjwZF/s07P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706865947, "uuid": "a7a5a823-df10-4c5c-9122-a798df57bdf9", "value": 50092, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706865947, "uuid": "f3aa262d-ced1-4a52-bfe0-6bb6fa5cc6b6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706865947, "uuid": "dc88b5ce-3ad6-4694-bb61-34a2ecc957ba", "value": "12dde44b4e3f650e4be8a94b5b6695a4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c6a4aed-c214-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RedLineStealer)", "timestamp": 1706910320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706910320, "uuid": "41de7528-3987-4722-88a5-5fd1f399008c", "comment": "Malware payload (RedLineStealer)", "value": "302f94c41a79a8178b1ed9c09df89635", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706910320, "uuid": "a39bd4a3-fea7-409e-9aee-ea88afee7124", "comment": "Malware payload (RedLineStealer)", "value": "14f629aebb73e61348018cc10933f58128dfdf25cb9c3103cb1569dca4eb0d36", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706910320, "uuid": "6355c50d-e7df-41ac-abd2-9f5e7793f0da", "comment": "Malware payload (RedLineStealer)", "value": "6800d537f7d95d5f85ce8234a4261cf921f7754a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706910320, "uuid": "d20b1d1c-2e99-4dd5-ae52-c2738541e7be", "comment": "Malware payload (RedLineStealer)", "value": "d28037bcb569341e5471011a13262288fc6b70f3dd30f52e1aed758fd02a89cd74d750473d0f9a3019ac0b0a6b021148", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706910320, "uuid": "4f3ef37a-5f55-4393-bf8b-bc4b03bffbb4", "value": "T13A46331B82C18ACAFA8613B2707E6CB5C793BEDD42B67085B732F405A1B90D73C9855D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706910320, "uuid": "4bc987fa-6d4d-4021-ae7e-4cb70284ae30", "value": "2e5467cba76f44a088d39f78c5e807b6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706910320, "uuid": "eebaa9a9-f66b-4d85-b4c4-d4e358831c2f", "value": "98304:deqWEOPgwb0gZJZB3uVzV5DPaCvUR+FUZbUJ4WWFZpRYdhyCmBdmnvgEz2q/YUC:dODbrNB+VzXDE+mpUJxWnYdECBnXzthC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706910320, "uuid": "323f313d-432b-4a03-8080-d0265acf93b7", "value": 5821744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706910320, "uuid": "e1baf84b-f3c2-44dd-a527-ed5dd517443d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706910320, "uuid": "05361300-b5c7-4f18-b4af-bf91df827c86", "value": "302F94C41A79A8178B1ED9C09DF89635.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b579df2-c1a5-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RiseProStealer)", "timestamp": 1706862590, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706862590, "uuid": "77479b81-39f6-4a4a-94bc-1a74c659053c", "comment": "Malware payload (RiseProStealer)", "value": "7015e8fc510e358062aac8054c289675", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706862590, "uuid": "3d9c0c83-bc82-4e4e-a801-fd01db99b1fc", "comment": "Malware payload (RiseProStealer)", "value": "171cc0088df22ec2c9d3d973d0593248c2f02d62257f088fa2b0e580a3148fba", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706862590, "uuid": "abb598bd-ddd0-45ac-8283-fc905fc48fd2", "comment": "Malware payload (RiseProStealer)", "value": "4e735a74fddf79ea7b80bf1978060cbf7c28a893", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706862590, "uuid": "ef4372b5-e213-4efd-8ced-371efe711a9a", "comment": "Malware payload (RiseProStealer)", "value": "bc1c03a76a56b7a86f405d581e33e3d02dd70ed9c6f850ad9454a5e9c38673b532cfee6696f227d5de0416e4d19b3869", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706862590, "uuid": "39b4b281-0a5f-4557-aacd-788d4e304fd6", "value": "T121563307FEC25856C449283CCE87BDAD32322F6D1A19861A7298B7DBECB7234513954F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706862590, "uuid": "c0eacc00-b57b-4477-af6f-d37ad2948de7", "value": "4329a5a28af84abf208d95062e79baad", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706862590, "uuid": "9010f73c-9f49-4cf5-86be-95186e85a01d", "value": "98304:vQnI/tCvmK40ZqXafM+iOcWbovdLhm6xu7907VirgN/CisBiu7F1aUBNFg4+:Ynd/jZk4qO5svdL5dVirgZuiu7F1pLgp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706862590, "uuid": "cca8ce34-2865-4e38-b7cb-f0c691d220c8", "value": 6125144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706862590, "uuid": "7406561e-3407-48c2-8028-e4688dc42b14", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706862590, "uuid": "742dddc9-f585-4bd8-b226-c3a9bea35b3e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bca6cd25-c1d6-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RiseProStealer)", "timestamp": 1706883852, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706883852, "uuid": "da4f82c1-d939-4d34-ac03-8026d0928146", "comment": "Malware payload (RiseProStealer)", "value": "eeec76a506c7bfaae3fe91bfae3e7bc8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706883852, "uuid": "0c635c21-44c4-426f-ab90-d4b54ec8f353", "comment": "Malware payload (RiseProStealer)", "value": "1ba36d7b73dba1eaa3b706415ca0686a474ee1662cf6ad94708e987bb1400758", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706883852, "uuid": "397eb44a-bef5-4f21-8a22-00f18d414070", "comment": "Malware payload (RiseProStealer)", "value": "5ecdf5385b6eb7cb43fdda492f8443b868f84e8e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706883852, "uuid": "3ca27a05-70ef-49ca-ba2a-3595206bd770", "comment": "Malware payload (RiseProStealer)", "value": "5274276c7fab414e1b3b578b501a180211db23d9d2c7cd3556faddfe97965bbe357ffb8a0fd69cc2af92d308a0241d2a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706883852, "uuid": "8d19362a-7249-40dc-b496-a6b6b237274d", "value": "T14BB533EA73B05251E407E7F8C65AA1252693BD1322D6FD00EBB4F96A8F3DDB1E508C50", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706883852, "uuid": "06d27f04-6efc-4d10-aa01-4358f5939631", "value": "baa93d47220682c04d92f7797d9224ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706883852, "uuid": "ad7345d0-fa53-4159-bb78-3fb16d46c21a", "value": "49152:Emo7zh//h7mL+FMNFbHow8hI/5gBKoE8zUiCqL/FxvQA03sULY:Wzh/JrMNdow8ySEOL/FxvQhcMY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706883852, "uuid": "74c02994-70bb-4991-a34e-c5582108d610", "value": 2345984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706883852, "uuid": "22d607d1-0f17-485f-a59f-a61e064ba981", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706883852, "uuid": "335ffe56-219c-4e4e-a538-89dde6ee9031", "value": "SecuriteInfo.com.Win32.TrojanX-gen.16213.27246", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f383b707-c190-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706853880, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706853880, "uuid": "ffdfd314-d706-4edd-9b16-36e9c9964c38", "comment": "Malware payload", "value": "5a1c4ed224988c96089d5ede74f5ce74", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706853880, "uuid": "8957cf22-f3a3-4664-8744-0247fb7a4509", "comment": "Malware payload", "value": "1eaec3aefd046e5371bb98e60e82d844b3017ba7b5915922e3987e20f3149147", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706853880, "uuid": "624a92bb-a1cb-47e0-94df-9d3fbe62ebab", "comment": "Malware payload", "value": "1f93850d83c0250ec4b6437e1fc66651b7cf24a6", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706853880, "uuid": "082ffd84-02dd-4e48-93bc-f9631673f3e4", "comment": "Malware payload", "value": "ebc9551690facb674ece3722e02ec3056edd46db8327e7d2d9354d5915c5834a00d95ae9a96b6cfab756ef5d6b8d984d", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706853880, "uuid": "5028ce95-fe1f-4c88-af73-834c0d1fe472", "value": "T1F06423DD6D5CCADD319E679ADE3E9683283F98C293F0D1E6149A4912DC70B1F62C1B02", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706853880, "uuid": "17cc6fca-882a-494b-90b3-06a1500a31fb", "value": "6144:tG/CmnCFU8x9VGrHKR3cXn4RGcczN9Tabs/hDAIjdQJoYVn72g3:yC0btzQs/hcIjdQN53", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706853880, "uuid": "2272cfc9-3927-467c-91a7-c6c559b5aba0", "value": 307305, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706853880, "uuid": "09c2841c-eed9-483e-9fbb-a2c0fd5f7667", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706853880, "uuid": "5baeee29-696d-4ef5-ac5a-260f9699475e", "value": "Document.pdf.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65dd102f-c223-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706916778, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706916778, "uuid": "eba627bf-fc6d-43c0-a907-0c3200e44883", "comment": "Malware payload", "value": "fbff3c4e12ffd51bbeebb7445547b4ee", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706916778, "uuid": "b1d66497-b49c-4f5a-a6c0-04a235b05a3f", "comment": "Malware payload", "value": "1f5bdeca95e56f530d84301ac656c0516996e991a61002b22ed3e56d324659c3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706916778, "uuid": "5c20c213-4caf-4009-95fa-8f6f8713b7b1", "comment": "Malware payload", "value": "de7505bf94834c046a66653b03edadba300dcc3d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706916778, "uuid": "e511a077-144e-4ea2-b5cf-eee68cfc26c3", "comment": "Malware payload", "value": "cfc0445a0728bb0134d18c4f8626aee858be5b1373a222fbefbb3ec2abd0a55a1a69f0186b7c590685dfa5a0b3d3fc5d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706916778, "uuid": "e6712e20-d1b6-494c-8744-8f55465dbaa1", "value": "T1FBB533CFC8B122CEC9D7A339613B668435636F93A52062AC35A5FB152FFF5306910E52", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706916778, "uuid": "1278cd52-5609-4664-b8c2-c222e7fb2a4b", "value": "baa93d47220682c04d92f7797d9224ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706916778, "uuid": "6f3ac304-13e2-4c86-89af-3f56c9bfa6da", "value": "49152:LlKZBfS7ubypM2NFlLz5RXijo9Iox3Ezg1KSEKQFfoB5wVA3b:xKZVLaNTLz/SXxZKafogK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706916778, "uuid": "0c7e779f-8910-48f4-be4d-874289561b8a", "value": 2311680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706916778, "uuid": "a815096f-0d6b-4bd1-811c-95eb145ab7bd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706916778, "uuid": "daf7e653-476a-4628-aea6-d5f93f4f5390", "value": "SecuriteInfo.com.Win32.TrojanX-gen.16208.29712", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25a99bd8-c1ce-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1706880163, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706880163, "uuid": "f89ae3a7-1407-4fa2-bfb5-cf4e88e4fc3f", "comment": "Malware payload (Socks5Systemz)", "value": "7c756f603569e8f88375d4e5d860cdb6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706880163, "uuid": "91f30f36-c794-4fcc-99e4-112e6e174518", "comment": "Malware payload (Socks5Systemz)", "value": "1f85ac615da37ae8880335354b63587cc5edc6fe787cda8425ee3a54c72f76da", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706880163, "uuid": "88c46eed-d78b-4ec9-9204-7d32aea8ca06", "comment": "Malware payload (Socks5Systemz)", "value": "6f54768517bec2afe241ce34d97e33cdf24a747e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706880163, "uuid": "392120b9-43e5-47a6-a439-2ed98673ab7d", "comment": "Malware payload (Socks5Systemz)", "value": "0b4d237c13fd2ec42c168057396f2e4407d1485f6edc2e218b5a839856d68352451c9cdb4507b564efebea00ed522b20", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706880163, "uuid": "374ed33a-e038-462a-8e40-b14ccb438b73", "value": "T1C376336A27907DF3E122DE307656B0194BD31F295478A5A8BD4D4CCCAFA38729DCF182", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706880163, "uuid": "722edddb-e1a0-4383-a37b-875b31f8984d", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706880163, "uuid": "9a32c7f3-62d0-431f-bdfa-cf63790626a3", "value": "98304:NmVnzO09gVjn2IYO8PLDyrYNHWeaDV+WHqtEu1jS1ObZNMyEwvYfEB2sdv7eaN8O:Q79cnpXcLurgWT+qq+roif2F6aynhMHf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706880163, "uuid": "40fb073e-63f2-4e9e-8e7e-ecf79b95311d", "value": 7471043, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706880163, "uuid": "66cf5096-84c1-472b-896a-620af2ad4346", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706880163, "uuid": "35b7cb6c-a5e4-41a6-891e-369d0ae25d94", "value": "7c756f603569e8f88375d4e5d860cdb6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07f276f6-c1ad-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1706865940, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706865940, "uuid": "43adb763-1779-4cf5-a6d3-824c37155842", "comment": "Malware payload (Mirai)", "value": "16fc96f33246fe32386a947e00870915", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706865940, "uuid": "8ce75943-7a97-4da4-9fde-20a20c300cbf", "comment": "Malware payload (Mirai)", "value": "20949be97bc5bd92a7a40c891ad97b3615f2d0487f1f368f2a21eae267672ea8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706865940, "uuid": "0b9f5b21-59f2-4567-9c93-26111f3236bd", "comment": "Malware payload (Mirai)", "value": "f71ce2b4d86e67f2c342dfba27f0a65dccb339c6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706865940, "uuid": "747f216f-fddd-4484-aac1-79c3b62839dc", "comment": "Malware payload (Mirai)", "value": "299487d9f036602e54cc9bd000fd09923029ee131a647d7ea6227dc2e149b59ca3fdc4f1a9caf6e0d698886361b6ada0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706865940, "uuid": "4996b91f-af5a-40e2-985f-8037b7dbe2b2", "value": "T155235CC5A447D9FCEC190A352177EF319AF6E93F1098D983C398AD73E942602E5072AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706865940, "uuid": "901edf51-0831-46be-bf02-2edd28d0aede", "value": "768:Ii+liNWE5NttVEi4Ws5BkbVTco8UBGWfd/0A6SDZkgoI:IiK25NttVEi4WszsVTcnWV/0A6OZk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706865940, "uuid": "7ba582a0-3dae-4fd8-ab82-af292f277a87", "value": 49756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706865940, "uuid": "aa10e8aa-1068-4961-bfc5-6505ce500306", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706865940, "uuid": "c5418d19-a376-4911-a94f-58221ad57e11", "value": "16fc96f33246fe32386a947e00870915", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d02b527e-c1b3-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706868853, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706868853, "uuid": "eb2710d9-790a-4e37-a2a4-7558bae71139", "comment": "Malware payload", "value": "8340768090e697e6797d79a049c15b43", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706868853, "uuid": "842db374-a828-45b6-8169-c0c1441927a6", "comment": "Malware payload", "value": "210831e58940c147b768224cd398985fc9a737201e2c541b814bfbf852c5fa77", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706868853, "uuid": "22c4c0ba-8fd6-4852-86e3-c1ec55fe33f5", "comment": "Malware payload", "value": "0e5496756ec59ba67eb08e0c62367b6d24f6187f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706868853, "uuid": "7944be6f-2b83-45e7-bc24-51d3a43e20d1", "comment": "Malware payload", "value": "31b3c6ec7ddee9a763c9c1800d4eab7742671e3bd0e9ae6d4d97dad2a0089b862090618e2fe71d26756e53a91b56df7b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706868853, "uuid": "2e732321-089d-448f-b870-bbba36736360", "value": "T14A04765E2F228F6EF269877047F34E305B6976DA16E1D680E1ACD5141F202CE641FBB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706868853, "uuid": "3279daf7-a8d8-493c-8409-b6c3c2a2bcb3", "value": "3072:j5v7AbP1q2Dr6pTL79hW27haDjT+mb6Z6H:dvEk5xZhW0anym+QH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706868853, "uuid": "70274ed0-e287-4394-a7d6-3048efc66974", "value": 179556, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706868853, "uuid": "8d6d967c-6370-40c4-aac9-dca451d74ebc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706868853, "uuid": "32b4fe9e-c12f-4b13-a4ee-6df6a70b3bf0", "value": "8340768090e697e6797d79a049c15b43", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12e047e0-c196-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Smoke Loader)", "timestamp": 1706856080, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706856080, "uuid": "b80319f3-1cc1-4e16-9eb6-a3bdf37b4043", "comment": "Malware payload (Smoke Loader)", "value": "5696e707bb2de303879e042ba9fb2681", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706856080, "uuid": "0dcd856f-0842-4a14-9c1c-844c6f941443", "comment": "Malware payload (Smoke Loader)", "value": "212cf81edf3cd280350b9dc6770ac93ecc254c2f54f8066bf37e2725c410389c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706856080, "uuid": "26c39ef7-3083-4659-97db-e54c6aba90d7", "comment": "Malware payload (Smoke Loader)", "value": "d31c6d321bcb949c8067b801f2565a73ad6b38a6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706856080, "uuid": "f091e430-b782-46c3-b78f-d62bd8a2fbd3", "comment": "Malware payload (Smoke Loader)", "value": "632384da52710b86fe9c243f29d164d6ad328d1fa2f37dd5ab2ad39cf79ebadf4e7f40a401594fd46cdef364966103d8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706856080, "uuid": "f3737379-96b8-487b-9f5c-3e1ce761d80c", "value": "T18934C061B5E2C5B6C6BB497078BCCAE45EBB7C665770805F33582B5F1D307C08AA9312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706856080, "uuid": "745e5a7e-c465-4314-9d8f-f1812b12f05f", "value": "710835a98f45566bd0f0ece9c36bfbe2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706856080, "uuid": "b8c72a55-43ed-44b2-9c61-3de96c98089f", "value": "3072:sGTO9LytnkyFI/Kvum8OJ0iv3TGoAbyxieCh4RSf1X7QP5IStpTG:W9LYFI/bmvJ0i/aouyxR69Sn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706856080, "uuid": "e63b7701-fff6-435a-9890-134ad9075725", "value": 236032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706856080, "uuid": "74036973-55e9-41bd-bb09-e045c8aa21de", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706856080, "uuid": "c10a98ec-3da4-46aa-9d00-5f141a6ab926", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f84f0a7e-c189-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1706850881, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706850881, "uuid": "d2cc11e0-4bd5-4f2c-87e9-0bda6a827f47", "comment": "Malware payload (Mirai)", "value": "da5d389540029feba460904ab6fd1b3f", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706850881, "uuid": "0a94754b-c287-486e-8c7b-03877654e8d1", "comment": "Malware payload (Mirai)", "value": "22218d0a953746299b02745b9d964124c525099d6c9a4be740cda1b58404723f", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706850881, "uuid": "77710211-e69d-4d05-ac26-1f0fcfb5b444", "comment": "Malware payload (Mirai)", "value": "5d4a874a3f7f5ef2c4eedbbfb4106f5e839072c0", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706850881, "uuid": "a2fb2fdf-d704-4923-8d29-ce2a269f3bf8", "comment": "Malware payload (Mirai)", "value": "59d892a75203b7943bcb4bc4290df29c5e465dd35fb3f3d68ebe2028437f308494ad058edf777d636c7db2777289c971", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706850881, "uuid": "00eec8e9-bbe0-4304-9a26-2e358aa0e31f", "value": "T1F114C81AAB610FFBDCAFDD3706E90B0129CCA44722A47B353674D528F54A64F49E3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706850881, "uuid": "de2306d6-cc31-436c-ad6f-24ae713fa1e6", "value": "3072:YWpJ3qHQ6F/RPpFTus5qpXnCNNvQXJnno:YS30RbS6qp3ovIZn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706850881, "uuid": "03890a08-4fc7-47a6-8025-7f8b1c734ff8", "value": 194964, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706850881, "uuid": "e2497d79-9a36-4552-b40a-fe13af9204d1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706850881, "uuid": "d86bd000-3c28-4cf9-9e5c-fe25a7a5f65e", "value": "huhu.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2e10bd0-c18c-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1706852026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706852026, "uuid": "d7cc988e-622b-4f9c-aa85-13d2ad56766e", "comment": "Malware payload (Mirai)", "value": "19d7d61c4c6b03076bdbccda1d6e974f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706852026, "uuid": "65b58c12-35ea-49c6-8e12-551a20324226", "comment": "Malware payload (Mirai)", "value": "224d52c663c18e390cca83d8f9ff8e9ecc4a6649af29d2100d72d5a2a56d652c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706852026, "uuid": "86913a9b-44af-42c3-8914-02efb21cefb4", "comment": "Malware payload (Mirai)", "value": "66035a85f4a5e08c3b715a7b000bcbdff5989b3b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706852026, "uuid": "874bae17-5949-43be-9c8f-235568370113", "comment": "Malware payload (Mirai)", "value": "5a632a89b605eade5cb369e68be33c7a274624517008ab7a164dfe15b4f2431d95e88ce9beed07fa3947aa261b14bebb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706852026, "uuid": "8bdb9913-5ff2-4378-89e0-b8a2063bdc8d", "value": "T18FE33A06B71C0A47D1A32EF03A3F6BD093AF9AC121F4F640255FAB8A9171D365546ECD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706852026, "uuid": "ac8d9e99-7274-4f04-adaf-6246854c9808", "value": "1536:iNzRp+tXmlNsyZs97xp3viRGbQo78hX4qOr1IvAxWs7HzDQ8qIOs43iOkcC:/v97xhKctcXsrPxI3iJcC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706852026, "uuid": "8729dc9b-4a8c-42d2-8c8c-73382c5cde5e", "value": 146556, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706852026, "uuid": "7b770703-e985-412e-8979-d6572cd93d81", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706852026, "uuid": "2af08b4d-2e18-4a93-b32f-00143313a741", "value": "19d7d61c4c6b03076bdbccda1d6e974f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc2f3c25-c1b3-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1706868926, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706868926, "uuid": "f14dcca6-8266-49a4-bdc9-7e840c81074a", "comment": "Malware payload (Mirai)", "value": "395a67933e3acacacbd23f229d2b780c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706868926, "uuid": "ed5a7f7f-e288-4acc-bfc4-5b0666bf9b8c", "comment": "Malware payload (Mirai)", "value": "22b8c33e47dc18abd7f3e8915ef79cb7b53b4302aa44b0203eb4e29af87e01b0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706868926, "uuid": "0b9faf1f-1c1f-48da-bcf4-316691d7dd61", "comment": "Malware payload (Mirai)", "value": "4085ee80be03a51791965154f3c51257cc60cdd0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706868926, "uuid": "898f65c7-f16c-474a-9fe9-9ab373107cac", "comment": "Malware payload (Mirai)", "value": "ea5392b1b5a24b7b57bb9a0b3bb7af8b5c76df90d5e4b28decf52dc705806fdce17ce2d1a61ac74ffe2f73e04d71133d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706868926, "uuid": "22a836c5-c8e5-4233-be1e-69005e542869", "value": "T171732956F9806F11E5D521BAFE0E0149339357B8E3EE72129D209B2537CBA6B0FB7502", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706868926, "uuid": "6482765a-9034-4a6f-8d28-0ace66888419", "value": "1536:6+nxA25aqa5OoZ5ImE5eta56SC5PgxQYfioHBVaqeSEY6tBillfiXKuBfML8cY7J:2257a5hZ59E5Ua5PC5P70imBVaqeSESy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706868926, "uuid": "fdfd8849-ae17-4f36-9fef-d2448dd6269d", "value": 77212, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706868926, "uuid": "eea223fd-614e-4bda-a80f-6c8dfea2a072", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706868926, "uuid": "e8ba0888-08b7-4681-a329-99cf59622a8e", "value": "395a67933e3acacacbd23f229d2b780c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfa275b3-c16e-11ee-b7ea-42010a9c0006", "comment": "Malware payload (IRATA)", "timestamp": 1706839190, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706839190, "uuid": "877ed167-86d0-4e4e-a04d-91ae44297436", "comment": "Malware payload (IRATA)", "value": "38fc481d5960943f887bd43f30ae2ded", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706839190, "uuid": "c4fc298f-59cb-45c7-ae4b-9e8a040a537b", "comment": "Malware payload (IRATA)", "value": "236c398b092c14358b149429e6cec4138c41992f64c01b99608576a2c3aa20c6", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706839190, "uuid": "b71623cf-32be-4112-87c6-ca4ab96ad78a", "comment": "Malware payload (IRATA)", "value": "8299754530808127c00b9109c34d2d4078180e5e", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706839190, "uuid": "a1fdcd4c-a47f-4662-9ce1-2bd475521040", "comment": "Malware payload (IRATA)", "value": "38594bc4ef270e31e6bde43802f6038674d43d879948f61a151e70e5ae9534e50ee49d1ab22d36e8f2802af9e6d5dab7", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706839190, "uuid": "272eb2ba-f777-4d69-9d1b-d51c3f9c75d8", "value": "T199F612DAE7949D6AD8F24332C57A92E142074C618B839F837D4C726C3BB36E04E597C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706839190, "uuid": "32ad54c7-50cf-4d7f-bba4-5791f645ee6c", "value": "196608:+HaCvOYhXjDU1vmFXOdOggEsig709Z2XXnB5GEKU+g1m8jJZq5P9KZz64TTYgzLs:+7BvOvmuLgEtY09khH5M8juKl6Us", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706839190, "uuid": "64899ccb-6f34-4f0c-bba9-ff48509d6f7b", "value": 16249613, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706839190, "uuid": "c5fca2bc-4fcd-4886-ad07-ae5c408799c6", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706839190, "uuid": "160f6d12-6c49-4cbe-90b5-72083deea41a", "value": "38fc481d5960943f887bd43f30ae2ded", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8995494-c1c8-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1706877806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706877806, "uuid": "f5ce92fd-6461-4b54-8e21-77de0cbf409e", "comment": "Malware payload (Mirai)", "value": "afd090f0efd9137602aa78a4333b13ab", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706877806, "uuid": "f035537f-8a10-480b-9206-8a4d9a4970d0", "comment": "Malware payload (Mirai)", "value": "244a20f09e85c072fcba4381f7f82d13e849b721fa28feafb2cd4afd7bc8472b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706877806, "uuid": "b97ee51e-09fe-4e8a-a1b4-65d66a8ae8e0", "comment": "Malware payload (Mirai)", "value": "c1063c3677145b1e54fb9bcd46cbb03de7c8737a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706877806, "uuid": "d32e7322-a417-4405-8b30-51d334937c57", "comment": "Malware payload (Mirai)", "value": "746eae43d6abfddaa4581128883cc6414cfcc7357552133d859d694eef0cb3fd7fa6c1dae7989eb3c9fdfc7c179d4b8e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706877806, "uuid": "36b76d65-0e12-4660-95bf-40ade4e0bb8f", "value": "T198D3D84ABD518F13C6C721F7FBDE029C3B266B69D6FA3102E9257FA037864D60936211", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706877806, "uuid": "5d9e16d8-adea-4b24-a860-7c814790afe7", "value": "1536:4C3QA9QJ6bVSfKAv2YhVcjcgnTd6A2wfHP70L93gPU8vn/OVHo8/G8zEIlG4wywh:dQAqpt2cVcjcg4JwX4LJgPUANuM9T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706877806, "uuid": "773dbec6-321a-49fe-8f98-f4fd0cf2f48a", "value": 134828, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706877806, "uuid": "0bd51cde-5643-4561-98fa-3859f849de4e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706877806, "uuid": "e710f0d8-1852-4bbf-97de-2bec75ce2c28", "value": "SecuriteInfo.com.Trojan.Linux.Agent.22749.18340", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05856859-c1a0-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1706860352, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706860352, "uuid": "67fbfde8-4c84-41d0-84b1-b53218f4beb0", "comment": "Malware payload (Mirai)", "value": "e8e971ddb93f97e005ddebc7b43412ed", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706860352, "uuid": "eafc2d9b-c31d-4b42-b20b-7da2c93ae031", "comment": "Malware payload (Mirai)", "value": "24d128249655b444ce8deccae9b9472a917d6ca7c44bb54c47114d155f420a15", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706860352, "uuid": "c71d50a2-5f83-4985-9092-99a382e6ba79", "comment": "Malware payload (Mirai)", "value": "c339b4e698deb648f595a6ad6a2c0548b342cd16", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706860352, "uuid": "34e4a046-7ae3-4774-a53a-6e56bd0ae4d2", "comment": "Malware payload (Mirai)", "value": "1a19a0391f2a8f8152f2b7fa7dd0e21f43ad3120fa6019458e42c62ba46112d0c453f1a0826ee558927fd399feb1ff47", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706860352, "uuid": "17465ea2-a485-4b89-906e-312806faee4b", "value": "T14C53B70E2E258FBDFB6C873547B78E259358339626E1C144E15CE9015EB434E781FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706860352, "uuid": "5fd5928e-0b78-4383-8823-8e3e26531adb", "value": "1536:Vbq/MDETn0Ast5RVBaGeIey1xtEVhowLe9V4gvfR:A/MDMn0Pt5RVkvy1AdLeHVnR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706860352, "uuid": "954e20b9-d3eb-4aea-9547-c343ab8eefea", "value": 64256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706860352, "uuid": "fa305923-5d36-49ad-85dc-5b3097086aa2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706860352, "uuid": "e9e550f6-16eb-4b3b-a133-4a69b52c881a", "value": "e8e971ddb93f97e005ddebc7b43412ed", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d166f409-c1ad-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1706866278, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706866278, "uuid": "f02b50cd-d60f-495d-8223-6f318adb906d", "comment": "Malware payload (Mirai)", "value": "ec25126c850ebac2d3f1a43773fbfb78", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706866278, "uuid": "9301f2d0-d989-4d7d-a4f0-64f8780e76b4", "comment": "Malware payload (Mirai)", "value": "251add4eb4e658b8dccb49053628fa80ca9ab4c5813fcd546bd62cd532555cc4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706866278, "uuid": "b074475b-d54b-461a-b40e-50602cdc9613", "comment": "Malware payload (Mirai)", "value": "92c18799bd01dc416f37abc812199f36cca3750e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706866278, "uuid": "90f21335-d554-4dc4-9743-8aa9fc7c1aeb", "comment": "Malware payload (Mirai)", "value": "69efc33cb8c64a0cb6459070d2b0676f22cd29f4cf3a024d6a7a9f71e251e76205dcde99473af71a25ef540951edeb09", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706866278, "uuid": "43023957-f092-4272-8e62-65e3fcccdb3a", "value": "T1E2531895BCE18A12C6D462B6FA2E418D332663E8D1DF3207DD216F1137CA82F0E7B556", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706866278, "uuid": "2a1a413a-d32e-4855-aaae-719fb75a9100", "value": "1536:IyFjHK/P+tm+6jDii/aJGMhrL2yBCECt5DmFx0o:IaY+tmGZhvZCbDmFxL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706866278, "uuid": "0a065c0a-c466-4752-abae-954b0aa46131", "value": 60788, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706866278, "uuid": "371cfd69-6131-4fca-9068-2b8ea0727ad1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706866278, "uuid": "b8ae2d43-1a57-4993-99cb-d1cfea0fe29f", "value": "ec25126c850ebac2d3f1a43773fbfb78", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c231363-c1cb-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706878912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706878912, "uuid": "1d6e5922-28fd-4314-937f-350c30f96043", "comment": "Malware payload", "value": "bd91ad1a50961d7ee0e75a9d15fb1f67", "object_relation": "md5", "Tag": [ { "name": "discord", "colour": "#27793F", "exportable": true, "hide_tag": false }, { "name": "EpsilonStealer", "colour": "#559F06", "exportable": true, "hide_tag": false }, { "name": "PlanetsTherapy", "colour": "#A55C4E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706878912, "uuid": "40f1ee28-bd61-469e-8716-0e40c419cde7", "comment": "Malware payload", "value": "256a7a494bbcffba7cffd16fcb65cc3de1ff61dc1f3078ee88534b87fdc84280", "object_relation": "sha256", "Tag": [ { "name": "discord", "colour": "#27793F", "exportable": true, "hide_tag": false }, { "name": "EpsilonStealer", "colour": "#559F06", "exportable": true, "hide_tag": false }, { "name": "PlanetsTherapy", "colour": "#A55C4E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706878912, "uuid": "1b4d52d2-03b3-4d08-ae12-371689e65eb2", "comment": "Malware payload", "value": "6875e31c0258440d70195c7ec6bb5a75654f3730", "object_relation": "sha1", "Tag": [ { "name": "discord", "colour": "#27793F", "exportable": true, "hide_tag": false }, { "name": "EpsilonStealer", "colour": "#559F06", "exportable": true, "hide_tag": false }, { "name": "PlanetsTherapy", "colour": "#A55C4E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706878912, "uuid": "27f8d370-4c04-4b9f-b9b4-48ca974ecede", "comment": "Malware payload", "value": "353ed8fb9ac51067a11feb7127f960cb5d7ed656304c982803646ffdcbccdca211fb7332c41e81debd41aa2302ac02dd", "object_relation": "sha3-384", "Tag": [ { "name": "discord", "colour": "#27793F", "exportable": true, "hide_tag": false }, { "name": "EpsilonStealer", "colour": "#559F06", "exportable": true, "hide_tag": false }, { "name": "PlanetsTherapy", "colour": "#A55C4E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706878912, "uuid": "838f663a-4603-4890-b08b-247e6b063af0", "value": "T148E733DC30E0E86BCC91083ED37DD59AD24113C3B591ABE13F26CA9935538768E25B7A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706878912, "uuid": "696076a5-ce11-4700-a300-176d34e33e2e", "value": "1572864:tm6smM8akdHWjcbuobCTBYCByJUi3YXQH8xvPAfD1WneNIYF:g6smXddHtaoiYLBoXQGODIOIYF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706878912, "uuid": "021ce5af-dd3d-42fb-b27d-59e547e84bcf", "value": 63935813, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706878912, "uuid": "8326b05a-7cb8-471d-b625-8d229a579d79", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706878912, "uuid": "3c145a27-70e7-4567-a5ed-e0ad5d82d3f9", "value": "Planets Therapy Setup.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c56742d-c1cb-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706878886, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706878886, "uuid": "696f6205-6b0e-4257-b9e2-31b1bc78b6b3", "comment": "Malware payload", "value": "de7ae9209cb0e3e2fe32962717fcfdf0", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706878886, "uuid": "e8a67321-b11b-41a8-a5f2-fc13c85a3a7b", "comment": "Malware payload", "value": "258e108164864adce19cec7ffda4daa864a608ffe2fa339f3d7ce22ee805747f", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706878886, "uuid": "a2418c40-975b-4e3e-9d23-d9cdb64c387d", "comment": "Malware payload", "value": "1cc278b9d68c588fccb215dd5e6ed0caeb26cde8", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706878886, "uuid": "b63cb186-dc70-4615-a058-cc3904380274", "comment": "Malware payload", "value": "24596daf995eaf47123148f0b658dce7ecd077c65243b1ea6c57dcd5ddcf392c83a93fde1d1b5cf45eef1fa0f3e9652d", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706878886, "uuid": "23be5c70-a52a-4bdc-982d-aa5bb5aa3128", "value": "T16FE61212AD8FC176EA9E8175D729FBAB12B67FF2077144E726C438CA18B09C151B5E03", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706878886, "uuid": "26c30be6-f083-4952-b96b-4a74f40da900", "value": "196608:t9OfKBWJH4fSj2pkYS4Q2n99wPMCZPCBG8gQ5iDesWcavlk04NGOYIrjccjjf:t9OWWJo399w00PChgQkD6cgj4Ljjf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706878886, "uuid": "ce503f8f-e34c-4fb2-84d8-47422892c60c", "value": 14334976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706878886, "uuid": "8152016d-3d0b-46e4-84e5-72ea12ef9cf7", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706878886, "uuid": "b943ac5b-047e-44a9-b584-87cd8658d57c", "value": "3df913f81936d77915e6156ed668b9eb9.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "049da48f-c1df-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706887409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706887409, "uuid": "e4a00622-d12a-41f3-8037-2c8277cce5d9", "comment": "Malware payload", "value": "73f7c1a3e249a56c0f695ff4ecb011cc", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706887409, "uuid": "a7c9b90a-2f4d-441d-89ec-950b8d214db0", "comment": "Malware payload", "value": "275cab2599793449b3457348d17b1eda852115f248d45a3de5ad77b953bce954", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706887409, "uuid": "358563f7-3186-43b4-8d12-de3e7c58b535", "comment": "Malware payload", "value": "175c6100108bf0a3fabdec86aab2f5be39887070", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706887409, "uuid": "3fb85006-95d2-4674-be42-37095562bf87", "comment": "Malware payload", "value": "a9e0727d56841ab785f19531d47548f0c69a554970ca2639a3c0ffaf8680ee0fcb49156759a00c54bbf6bfca76d6e27e", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706887409, "uuid": "972304bc-0cb3-4796-8093-f527d9cfc3fa", "value": "T1F5F4335073C10A84FE13CE34B59A9B32B067A99846B8B46DA37083DDC4F8E9DF16635D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706887409, "uuid": "3a4a51da-b346-409e-88f4-f10a3d9ca5a6", "value": "12288:eZzOi5WyixkNlvwJl+Zr8Ia+Cm3deL0dPx6hLdI8xU9qLPDcy0kW:e4i5HixmvwyZ/Cm3WQkhaqP4cW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706887409, "uuid": "95164591-7136-4136-a2ce-2cc5f612ff89", "value": 749775, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706887409, "uuid": "74e29109-7dc0-4784-8e3a-e5444c514258", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706887409, "uuid": "095c9c9f-e277-4852-9cb1-66a4388f2a2b", "value": "SecuriteInfo.com.Trojan.004bcce41.19669.28538", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50ad1059-c185-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1706848882, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706848882, "uuid": "6d5821e6-f6a2-4ce5-baad-f320575c4157", "comment": "Malware payload (AgentTesla)", "value": "606ec45364e9195ccbd7957c08c77f04", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706848882, "uuid": "4389f289-440d-45bf-91a9-46dba69f9dbb", "comment": "Malware payload (AgentTesla)", "value": "276c7195677d36fa861b7f6561986947ff18b4ae5a2171e5f23ef07cb525970e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706848882, "uuid": "6387b72a-f361-4be5-9828-d969eaf2e73b", "comment": "Malware payload (AgentTesla)", "value": "d9a1094c2c85aa1d687ad4eaaf25dccd9dbff6cd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706848882, "uuid": "c3252d5e-3ca9-4151-8783-90f05e0a5cd3", "comment": "Malware payload (AgentTesla)", "value": "ffc2ba86217ccfcb0c1539a169835e73e708eb796fca0881c0adf00c1129569517b23d3321c9dd328e1a715cd5f920b4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706848882, "uuid": "3c576817-30b3-46ff-99ed-28db2dc27a64", "value": "T1DDA4120A87D4C769DAEAE1F4F82C2FA13BB5C7C52E16C7024CEC44E21E877451E7A652", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706848882, "uuid": "d1e7ad94-9b9b-49d4-b6f8-247c4b551563", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706848882, "uuid": "1a2146a4-1850-4cf8-8495-c75862d053fe", "value": "12288:3DuLGQiTz/8OVFTKw2DgRFt200hmtuwgO02ww:3SaQiTz/8Gohgv85utZ02ww", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706848882, "uuid": "e04017d4-9b9b-4a81-9913-e753667c8612", "value": 471552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706848882, "uuid": "a3d04210-ccb3-4480-b25c-524685954621", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706848882, "uuid": "16821e3c-6ba7-4daa-bb1e-ce206cd73788", "value": "606ec45364e9195ccbd7957c08c77f04", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2922e18-c1ad-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1706866253, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706866253, "uuid": "3ea99edb-9486-4e85-af06-ca514abcb410", "comment": "Malware payload (Mirai)", "value": "4db428c8d0324ea3510ffdf4721bdfd8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706866253, "uuid": "84e53f27-ee5f-4606-8032-02785cdb05cf", "comment": "Malware payload (Mirai)", "value": "27a079ad2b99d901e62a110e7cde46fcb39d8f298f333d2ed3af81eb0f11669e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706866253, "uuid": "6a835339-7924-4f11-b9f8-b2c705567071", "comment": "Malware payload (Mirai)", "value": "88e669db081cbe12de20d24b038179a65a1fa456", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706866253, "uuid": "74dd5e65-eed3-463f-94e4-410a1752c153", "comment": "Malware payload (Mirai)", "value": "e66446c46c11d5909031b517173a5d3788b1f9e49554077375e1776cfba21aa1eeade08ce5ee221883d97c43222ba417", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706866253, "uuid": "9fdd872e-9b6a-4486-ac87-609e8e8bae2b", "value": "T10F237DA7C43C7DD4D15982B8AD248A3C5B23E006A6933EF6B64785628047EECF60D3F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706866253, "uuid": "96b3a393-e735-428c-ab05-a4b8dbd03a0f", "value": "768:f/eptstaT85n1OeatwtgJ04OCqNrKd7LGAQJqx5j/XObFQ9CWo29a1CaUE:f/6s+YtatwtgRSKuu5L+S6Oa1Ca", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706866253, "uuid": "588973b5-7403-488b-bf5b-0604a4140234", "value": 47556, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706866253, "uuid": "e2677f38-6099-417d-b3ca-f6e352026e29", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706866253, "uuid": "457912a7-c7cd-4e85-8cde-c6cc08144634", "value": "4db428c8d0324ea3510ffdf4721bdfd8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f566f38-c1e7-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706891078, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706891078, "uuid": "eeca89e4-444c-4891-a339-1eb34b3772f0", "comment": "Malware payload", "value": "6da69b8791c12096042659efcca980c5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706891078, "uuid": "2ef7f9e1-3bf9-4934-a6f1-4b01911eddbd", "comment": "Malware payload", "value": "27faca387d9a8e5c7e43366b3eb4e0e108c9bc1bbfade960a7a41eb134f0eae0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706891078, "uuid": "d311c860-6407-4925-9f6d-bdb6273b8c0e", "comment": "Malware payload", "value": "f0612c041b348a9c36af965257549e588eb8e319", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706891078, "uuid": "9886578f-e3c7-4e91-83a9-9669ea34fcac", "comment": "Malware payload", "value": "41dd61364d448fd1cea70ac50cb10789e5be27ec614da9cbecf4f2df71f1c347c8dd59fd396a1bb3845d0102b283a2a2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706891078, "uuid": "ed2bd863-b2f5-429a-bc2b-d999fccea267", "value": "T13CF31A9D3651B2DFC857D8728AE81CACF661787A872F4503E42726ADDA2C847CF150F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706891078, "uuid": "024dba44-b2ab-431d-933d-4a42283bd8a8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706891078, "uuid": "54a0aa40-39cb-455e-91c1-8ec388c63020", "value": "3072:FNmToc/9WT8Jfn6bLw+e87ZO1uHRneGX8XAr8x8SXdE:FMTdFWAC3wzwO1aRneGX8XAr8xHXd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706891078, "uuid": "3f310ff7-b893-474f-b95d-80ab19ff8342", "value": 159232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706891078, "uuid": "b7d59eab-bc2a-40e5-bcee-80165a84582b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706891078, "uuid": "59c7f480-6b5c-4500-b8ee-97088e4d9674", "value": "SecuriteInfo.com.Win32.CoinminerX-gen.29269.21386", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28eee369-c1ce-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RiseProStealer)", "timestamp": 1706880168, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706880168, "uuid": "eff4925e-d6c0-4ca5-8011-b18e19bc0c9d", "comment": "Malware payload (RiseProStealer)", "value": "0a4b84a8d0915c93c9735aa095c573b7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706880168, "uuid": "31eb2235-a472-4987-8d14-ff50fa66c4b0", "comment": "Malware payload (RiseProStealer)", "value": "28e6bbc4ef21d8617ddf8c417b8b9eb722974bb0f18147725beed574a87ce2d6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706880168, "uuid": "9ce5f444-11dc-4323-abe3-8d8f6e981f97", "comment": "Malware payload (RiseProStealer)", "value": "794b7e3f3c22f55038b85f21636a1d701f49b81c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706880168, "uuid": "1f5c6339-e378-4fbb-aaee-013aa096b214", "comment": "Malware payload (RiseProStealer)", "value": "e13da0228b183c416de4b7765c1a3ce105cd7f193dbcde9ad30ad7b481aaef81074166fca5170d20a6206865510c436f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706880168, "uuid": "d76ece28-0b22-4c50-9498-4344c06077fe", "value": "T127A533E02DB727AAD927473F22447509A2935C83E94EF190AA49F5D2937F9B30617F03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706880168, "uuid": "c9c7c4c8-2bb8-4e30-a86e-73a4a3f30428", "value": "baa93d47220682c04d92f7797d9224ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706880168, "uuid": "684e69b5-1416-4c50-b1ef-32faf82e533a", "value": "49152:i0CiVVuUugafDcp1cAnAAAxcinIvj+m+vdqK+eV5IGxkp:Qiqop1BnAxxd0+m+VzVI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706880168, "uuid": "50edc6f6-0c46-41e0-ac2d-819b79f6495d", "value": 2253824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706880168, "uuid": "f38d20e1-284d-4dd7-8449-64abb7d5d668", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706880168, "uuid": "ca086abd-c84f-4cf3-9b54-b94c4260be63", "value": "0a4b84a8d0915c93c9735aa095c573b7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37f59742-c196-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Fabookie)", "timestamp": 1706856142, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706856142, "uuid": "eac10735-9084-444d-89e9-c83cf87be8b9", "comment": "Malware payload (Fabookie)", "value": "ca13816919b4505dbefba7145088b97c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706856142, "uuid": "d1078cf0-cb0e-44a1-b844-0da3cf43e8a4", "comment": "Malware payload (Fabookie)", "value": "28f74f8d6c20bab3d7b75c8210c553e67bc49fccf147f0fa27e4b5b7a2002560", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706856142, "uuid": "73d15cbb-9928-446c-95fc-4923a81026c1", "comment": "Malware payload (Fabookie)", "value": "dcf00f75914ec2a1849b55c727865573355c83a5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706856142, "uuid": "0a38f84e-7580-4cb2-b86e-eacf0bd31add", "comment": "Malware payload (Fabookie)", "value": "052985ba4b79b998fd3fcb495cd88fae38d06dd1f4f2baa6e1a78b40e411d47806e0eda44a07dadb4ddd6821e1cd7a0f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706856142, "uuid": "232a5395-fca2-4f7b-a173-409db3225d34", "value": "T1CC544912AB25DFB8F0C7C8B6BD30410218E8B4097758B57E96CDCC751A3BC51ADB5AB2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706856142, "uuid": "cede0d3b-bcd7-47e4-b7f0-cad7e289c4f4", "value": "5f7cc0f5167c2e87d5d2573013f2660f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706856142, "uuid": "46543499-cec3-4846-bee2-3e2465eecc93", "value": "6144:k7F5GxMr+PtCE2kWCZ3j9Z0CINiNbpxyN90vE:4FYxMqAEVBkCIWLy90", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706856142, "uuid": "29a06845-32e3-430f-b553-944f99d30464", "value": 305664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706856142, "uuid": "846f65d3-5b46-411a-8370-46a35a59d834", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706856142, "uuid": "36841cd8-ecd3-45f9-a8e9-3de7019653f3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed542041-c189-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1706850863, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706850863, "uuid": "b3205368-6124-4f6c-bee6-907629cd7d18", "comment": "Malware payload (Mirai)", "value": "0cf8c3c29c266a1249355612d561f785", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706850863, "uuid": "3d942859-f875-4d12-aa89-daadb1a84e98", "comment": "Malware payload (Mirai)", "value": "2b6f42cdf2086baba1554545343dc1090ceab7d156d967606e64cc15ca549db6", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706850863, "uuid": "ad8fa7ee-81db-4eb3-9be3-2e2afe79f0f0", "comment": "Malware payload (Mirai)", "value": "c5c3d44a7907e638e463806c970bcb87ffa8fb66", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706850863, "uuid": "9ca4d14f-20d4-4994-9339-387a90e2ce95", "comment": "Malware payload (Mirai)", "value": "c9976109d51b81021863cb7aeacbd825733e775f4dc9ccbd928ba25db21d1381d53f36ff3a576792a587344af90cf861", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706850863, "uuid": "f798f0aa-600f-4856-967e-4c0c65e508d5", "value": "T19A14971E6E228F7EF7A8873047B78E25975C23D627E1D684D1ACC1105E6039E641FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706850863, "uuid": "15aa9977-45b3-4086-8a0c-82690d7ef18e", "value": "3072:Zc6WEwpCkOSW9JFrMzCjbCs/QtYh2OippWp7D/JXvc9aJp8Z:ZaEwcJheI2bLWND9v4arW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706850863, "uuid": "5b52eb37-5f83-4400-a826-ecf4b9aa35e8", "value": 194580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706850863, "uuid": "329b65fb-bb40-4786-b463-7d8e0168d6eb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706850863, "uuid": "52e66fe5-3786-4cd8-a174-9453b6dbef8e", "value": "huhu.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94071836-c1a5-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706862739, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706862739, "uuid": "41cb01fa-47e1-4d35-9990-511be8f238ce", "comment": "Malware payload", "value": "2ba62bf3bcfd7f841a6bddeab071c566", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706862739, "uuid": "19b4af63-4fb2-4061-ba41-796a2231a6eb", "comment": "Malware payload", "value": "2c0ee7d5b6036e6cda62203de9d1a46f881d033021d17f80c0cd053e1c736f05", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706862739, "uuid": "f881db2f-3905-423f-b333-9efa4c9f5370", "comment": "Malware payload", "value": "12ae720aaaaa55cfe764549e32e488025ee6fab6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706862739, "uuid": "532bdfe3-80d9-4a34-8b95-057aa956ac74", "comment": "Malware payload", "value": "b6b763b7ac29739529fe8fcc8c6ca3e636d15a8f42575e1de88b6fadb8ceaacc4891680b343ba1403b813fce1e9d0840", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706862739, "uuid": "10100afc-4978-4371-b068-ed5b04688b82", "value": "T14E649E97F2A558F8E0672038945BF35FFAB534184B1486D733E844587FE27E0A9BA312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706862739, "uuid": "10de94e2-c1e6-4863-8a6c-79bd2ee25e98", "value": "50b30da1b43153598da37c3f8b076066", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706862739, "uuid": "b6b1e954-6f88-4cd0-98ce-51dfb760d340", "value": "6144:Dsex2RoW3658VZRXsdVxp/0SRCotu9nqSOj:DseVW348vRgp89nqF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706862739, "uuid": "49d1734f-47d5-4abd-9e59-fdb20bd67db9", "value": 322048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706862739, "uuid": "be2cf033-fb03-4678-9b46-67916656a1f5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706862739, "uuid": "2494863c-91e7-4cc4-ac6c-fc6af52af612", "value": "SecuriteInfo.com.Win64.MalwareX-gen.22711.28884", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcc08893-c1ad-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1706866297, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706866297, "uuid": "63758ee5-86ef-4033-9bc7-8e1ac7f13db2", "comment": "Malware payload (Mirai)", "value": "30c53f5b91a10fe7007eada63f3d2d03", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706866297, "uuid": "3b927f62-08fc-4206-a946-79abb9d73ac9", "comment": "Malware payload (Mirai)", "value": "2c6acadf99337eb776d8903a1015053691b2a43393f4bb2c167b8301eaa8b657", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706866297, "uuid": "cea4435d-f266-41cf-b6d8-79f1257dbd47", "comment": "Malware payload (Mirai)", "value": "1703c90f8f0b8ca7aaa5d3b417630619af610fa4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706866297, "uuid": "ee065b3b-f359-4a53-842d-a28c50146d5e", "comment": "Malware payload (Mirai)", "value": "dc662692ba3fe04e55e74846369407515f440e77bcab748567acc5405ff4efa0e45c4517c59ccc03d81ee500b780190c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706866297, "uuid": "8f053cf3-f5da-464f-b96b-35a599cfe422", "value": "T1E4435BC5D563D9FCDC1015393077FF725A76E93F1028EAC7D7A8A932A982A02D90728D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706866297, "uuid": "6f01933c-a77c-49a5-bc9f-93c4d554109d", "value": "1536:d6EwVWibZ6uzpNrmvFtWbFg7WCTZrt+xc:QVWYZ6uzv4FKFg7WoZrQq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706866297, "uuid": "e0bc873b-f5a2-44b3-857e-b26e91466083", "value": 55840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706866297, "uuid": "ee84db3f-a88e-43df-8325-285562be5f20", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706866297, "uuid": "fff37799-6132-489a-aac6-b0aebc1f0a3d", "value": "30c53f5b91a10fe7007eada63f3d2d03", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd48548e-c1b3-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1706868848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706868848, "uuid": "d1a04e4d-5f2a-4407-a9e4-e8889335659f", "comment": "Malware payload (Mirai)", "value": "f49067c7d9485bb6b6a79e4a5c393326", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706868848, "uuid": "721f9bdd-99ad-4b5b-9bcf-577604ffc7de", "comment": "Malware payload (Mirai)", "value": "2d28b366c2a94b576ac4565731a13ee337e86b9482c73622e5a90ba8b5fd1608", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706868848, "uuid": "96fd70c0-f1cd-4864-9dca-79cec674823e", "comment": "Malware payload (Mirai)", "value": "6566e7ce98593ca32dd5aa4e2c1875a0065c03ba", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706868848, "uuid": "43c32ed5-cdf7-49f8-a5b1-88e5b40e3998", "comment": "Malware payload (Mirai)", "value": "7a504a18f3e14425ffccd07c5209b933db6167fd211ae6f7b781802eae717ac0c301dae81e504ece83ed20dcc6e51945", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706868848, "uuid": "1bcd2d8d-7fbc-43ad-b0ca-fa1a1ad25432", "value": "T1C7234A032592D1FCCD6FC3F4176AB972E13B713D0135A64A5BECFE211F4AD601A6A648", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706868848, "uuid": "3b29e024-c0a6-406a-9b29-606a4988c82a", "value": "768:5gplhuslrXelfl66UBsnCixj8BJQj8eu299I3rXSL1XI2OJi3UnUkYIlV:klhuslrXelfl66UBsnCixj8Bpeu88jSy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706868848, "uuid": "4da7626f-ed40-430a-80bf-cbe409028f86", "value": 47328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706868848, "uuid": "3dd9e9c4-9cbe-40ad-8600-59022fdbe2c7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706868848, "uuid": "b8973579-c9e0-49b7-a3f5-6aef958e9ffb", "value": "f49067c7d9485bb6b6a79e4a5c393326", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2d0cef3-c1b3-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1706868857, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706868857, "uuid": "d5040481-9109-4230-bef0-ad824983a6d3", "comment": "Malware payload (Mirai)", "value": "e9836db4378f5bf0343eacc14b195cdb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706868857, "uuid": "d4372a3b-7968-4ea3-8475-aa041c297c64", "comment": "Malware payload (Mirai)", "value": "2f21154802025c732c4f49a2a8a54f9263e5b8aa71f91f9d1a39c504b43f8aba", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706868857, "uuid": "7debed2a-e09f-473d-abc9-85012e7c4e4f", "comment": "Malware payload (Mirai)", "value": "d0cf4ecbbebe428137e45dfc1d7909bf8448fb7e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706868857, "uuid": "717803b7-26c0-4f77-b808-080cd3851606", "comment": "Malware payload (Mirai)", "value": "dbd05e4623618672f38fda560bd651a9baa82b3f80be1857f4adcf7677738f047730732c65da20b583e371b776cc8429", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706868857, "uuid": "5c9cb8ab-0726-4302-ab47-cb943ba4644e", "value": "T1F753A65A6D128FACFB5D873147B78E21AA5837D637D1C641E26CDA002E7034E641FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706868857, "uuid": "c25c591c-187d-401a-b3fe-320fc287e79d", "value": "768:LK11B+Aje4WYh4WlNJJFc3KD4MkGcl+5uCY0SmvEEt0MSdOy5nTw9K:ui4t42Fc4RYkQjdOcncA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706868857, "uuid": "1b5b6dc9-8845-47c4-b2bb-62ab67ba43cd", "value": 63732, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706868857, "uuid": "fcfd7a60-7eca-4918-900e-bb46439e4bf9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706868857, "uuid": "8b875460-9a5d-4b2e-ba73-1b18351d6433", "value": "e9836db4378f5bf0343eacc14b195cdb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98ad9814-c1b4-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1706869189, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706869189, "uuid": "63266c40-8198-46f9-b782-8cef027d405e", "comment": "Malware payload (Socks5Systemz)", "value": "c40b9ed45b7bdaa0bd9f59d1a50ff467", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706869189, "uuid": "0c7d582c-9f43-4152-861e-f4004be442e8", "comment": "Malware payload (Socks5Systemz)", "value": "3016a9d61a8d6540ea38c23a09d4503e344ad2e2e03f2fd0b6d06425e81ac579", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706869189, "uuid": "3a7afcc0-27ff-4055-8786-6464cf427c8f", "comment": "Malware payload (Socks5Systemz)", "value": "7301010b000e79364025024a4cba6437188eb02a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706869189, "uuid": "9e9eeb9d-5eaa-4322-aa38-f70c0cc17084", "comment": "Malware payload (Socks5Systemz)", "value": "8b6386734eb81690c91aa55009f0aa9382a9e295c73330ef275ccb02ef4a8c97c75158735db1387809db358ef6809cb9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706869189, "uuid": "86863e1b-0e02-429a-8846-7708326d1ad1", "value": "T13556331F144A4633C8A0CD3948B6E40ED7FA5E6A5CF036717328BD8BBF1A8253C56DA4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706869189, "uuid": "7354fe8f-3a58-4afc-9dcc-543ef6c7f247", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706869189, "uuid": "6e9aa005-374c-40fd-b2bd-3cee694cc062", "value": "196608:92e0XssSRMrZ2BytTwWrK9MJT3rKnF/+WpswBPRWZe:9UWMr4BytTrrK9qTsF/+WpNB0A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706869189, "uuid": "c0e4303b-541c-458b-bab7-1fa0b857b150", "value": 6426096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706869189, "uuid": "6631a51a-8bf5-406c-b74f-293f27ed4333", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706869189, "uuid": "fc8dd2a1-ee13-425c-a638-82965101d571", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "646ca831-c223-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706916775, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706916775, "uuid": "36b1a83c-6637-4b77-899b-20ab670aafe5", "comment": "Malware payload", "value": "2ac86eec75add78a539f21c20257529d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706916775, "uuid": "40b47518-28fe-4d79-8366-d53215c1ec79", "comment": "Malware payload", "value": "3028c4efec4d494f0d1fb0420f268c896185cab6906212b5bda7de849bb9db30", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706916775, "uuid": "72185847-7cde-4672-86c6-db8c46bcef0e", "comment": "Malware payload", "value": "bcf33430a81cc3fd4e1e73de9ce0244ce88a033b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706916775, "uuid": "17cb6850-81ca-4e2c-bb34-0e8d8959a789", "comment": "Malware payload", "value": "81f5010c5c84d6170b59d3d0d5d0a90653a7ae661e9a50920342db8b678637c995365e2442d10016bd75646b12a81d91", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706916775, "uuid": "47fb6072-331a-4868-a750-54b33fb2e92c", "value": "T149B533E63FF91158E897437BA593683411A3BEABE2610FA87C0BF899133C6342457F51", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706916775, "uuid": "4949cd50-d3e9-44af-8639-5050487b6c6f", "value": "baa93d47220682c04d92f7797d9224ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706916775, "uuid": "68d789f7-9df4-4730-8be8-e22259dd321e", "value": "49152:A9Je2wHRmk+iV/iTroBcFjKpzgJzKcFQfLc:A6L/rdi3oCegFF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706916775, "uuid": "3a0d84d4-493a-4174-9497-ac5dd422f291", "value": 2351104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706916775, "uuid": "228ea1d9-7aff-43a7-8111-e7d738ae5399", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706916775, "uuid": "cfc44c2d-407e-49d3-b413-6d607a02ff3b", "value": "SecuriteInfo.com.Win32.TrojanX-gen.14108.29028", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc52eb75-c1de-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706887395, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706887395, "uuid": "fd87e16d-e1d8-4298-acc4-a84d3cdcac9d", "comment": "Malware payload", "value": "930cee766514aa4590810bfbe883058b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706887395, "uuid": "d9db0184-5f45-4644-a53d-ada69cd248d0", "comment": "Malware payload", "value": "316e9402e0bd779775ae3a4a0f3add883d2a4af17b05e195bfac54172e97e4aa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706887395, "uuid": "74699dac-5d83-455f-bb48-db54f1cb89a4", "comment": "Malware payload", "value": "b85c476e86e2f76d7b3f77e8bd7445af10a4dfe9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706887395, "uuid": "fcd8ebf7-d582-4a2d-b36c-98cfc2138d9f", "comment": "Malware payload", "value": "c14d98d4382ded44e5f2dd40c6229d19b8a323c6e146f8380bce4fba34a2cc1e650417d62afdd0e660630432351e181e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706887395, "uuid": "d73f6bfe-1d51-40e8-9be2-ef3620fd6d33", "value": "T11C335B49BBE012BEE6B28972254717361F36FD2105299E4BB95F6B841331009CBFA39D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706887395, "uuid": "0fa6ef56-0c46-4c7d-b2a4-c6371fc9210b", "value": "768:H3cg/tSQV0Ag24bzyWY57+LZuhH++xPs:MglSQqAYyWYV+che", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706887395, "uuid": "b42616e0-05c1-4e23-a39e-19b22223291b", "value": 53248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706887395, "uuid": "408cacf0-42f2-4115-81e2-bdad7ef57cf2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706887395, "uuid": "44b9c737-de62-48df-9026-b3eb90325409", "value": "SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.28117.29388", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b35ab417-c200-11ee-b7ea-42010a9c0006", "comment": "Malware payload (LummaStealer)", "timestamp": 1706901875, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706901875, "uuid": "c1770088-775b-4bfd-85aa-64e7bcb0d363", "comment": "Malware payload (LummaStealer)", "value": "0f92f5314f8e572e3074c0d1a845350c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706901875, "uuid": "371a7246-5662-4690-8b64-aa427e6f3095", "comment": "Malware payload (LummaStealer)", "value": "325ce6a660651f8440992a0c179abdc1cfbb9d49d96aacf9e81a7467fc5b639f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706901875, "uuid": "3c220c07-2d75-4958-82bf-40d96c085643", "comment": "Malware payload (LummaStealer)", "value": "97cbf15f4501469a56e33bdbbeb7f6db76d511f3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706901875, "uuid": "d2a3a4fc-8855-4420-9b23-e9e98237f121", "comment": "Malware payload (LummaStealer)", "value": "104c3718cc416bb576110fd4a5f7d512d81cd87aa7f9d773a2d73e3082f0e274d6fb8dc317b938b7d77c3a371551a098", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706901875, "uuid": "fc94c3a9-63fc-487b-b34f-b1709f20e310", "value": "T18CD47BF169C12E35F5D70C78AF4AF0FC41C0965E59A3C28689A1B714B8E3E79F532A18", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706901875, "uuid": "979df2b3-a0d6-4696-9f9f-6a436381837e", "value": "bcaada7db1c3b7a0077de29a4546c424", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706901875, "uuid": "70636dba-3db6-4fa5-8b1d-d993112ecdf6", "value": "12288:eJejf0e2xCe92o8nRftO433uczs8GT0rFFfw:e60Jf9L85DE8GT0rPfw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706901875, "uuid": "a82b764c-8cf1-43b8-9f17-b82d4a48700a", "value": 631112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706901875, "uuid": "60620ff6-dbbc-413c-86f3-89a0d5c6a79e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706901875, "uuid": "84982d6a-aa16-4947-ba6d-2aca04d6b665", "value": "SecuriteInfo.com.Win32.PWSX-gen.32657.19930", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fe10676-c1ad-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1706865953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706865953, "uuid": "6cd492f8-65ed-4256-bbb4-c808f311544c", "comment": "Malware payload (Mirai)", "value": "51b714303f10ba038063380d3a3039af", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706865953, "uuid": "0248755e-68e8-4a4f-92f8-a70d250e2b05", "comment": "Malware payload (Mirai)", "value": "32b3b7c7639752342bab3d3e236a9d781acf4e3f0fe5cf6ee85a5a1997bc835f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706865953, "uuid": "bba44e66-add2-4ed4-90eb-6439a7883416", "comment": "Malware payload (Mirai)", "value": "72b0e53fe29313c32acf2139920bb56ba3169b95", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706865953, "uuid": "ce186206-3adb-453a-afc3-35f14ca3e82b", "comment": "Malware payload (Mirai)", "value": "68af8a66df06d4e8b48ed40bbfc5d2bc96d3d674ecc22caa6879c5360b994fddbf854a3aabfc3195b512615571dba22e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706865953, "uuid": "3a7bacc5-560a-4473-8bb2-07fd04113d74", "value": "T10B639209BF611FF7EC6FDC374AE92B4525DD641A21A83B397930D818F24A24B19E3874", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706865953, "uuid": "db9e9c50-c52d-4068-b08a-9030edd5f994", "value": "768:CDScD5GY2naf8i2Sxt9yYExR15IGI5vTemle5Re5brvuX5XiANe1j9OE:CDSC5G9afb249FKvI5fl8RWb7Sq1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706865953, "uuid": "123c078e-1967-4008-996f-a17a6a5aa9bf", "value": 71568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706865953, "uuid": "3a9ba6ac-e27b-403e-a4e0-5b85a28e78a7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706865953, "uuid": "cf337797-300f-4f2f-bce5-091fc504d9d2", "value": "51b714303f10ba038063380d3a3039af", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cbcbd22-c18f-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706853117, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706853117, "uuid": "b2152665-9bfc-4410-80b6-99672e327cdb", "comment": "Malware payload", "value": "0db27ac51f9e74572ec2def69c5d317a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706853117, "uuid": "610feaa4-221b-4b3a-b0f4-8da982f2eedf", "comment": "Malware payload", "value": "33378b9c4779232f3707ace36a6dc5f6e58175472eb6d8b2f27293ba01b947bc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706853117, "uuid": "a6d348e2-a253-41dd-87c0-f645d8151a66", "comment": "Malware payload", "value": "6b39e78365be18da479ae8967016e4c607b519ba", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706853117, "uuid": "32bec4d0-10b3-4c16-9fff-86db11075c07", "comment": "Malware payload", "value": "6176bba5844d9a0230f65c713507e3832fcedebe462015a2cc2fbbe7211122f674710c33b7e85958f9f37566d5dde034", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706853117, "uuid": "e52565e1-bbd8-40e6-bf0f-913cfb14fed6", "value": "T1E5C44B00ABE89A6AD0AE6BF358B107450BF5F582D595EB4BC48131E91F62706ED0373F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706853117, "uuid": "a3402611-28c0-4aca-8419-7a3855d07628", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706853117, "uuid": "8181457e-edaf-4b76-9878-b20a1a2a6f4f", "value": "12288:NqlcVpdb2Wrm/9glARgVwRlqQmGALPokP5dVR2oXA42wcBiDQRD/Tz4ASe3/hxvG:NNpdb2Wrm/9glARgVwRlqQmGALPokP5p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706853117, "uuid": "0ddeaba0-55e9-4800-8729-8579f15c680e", "value": 571904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706853117, "uuid": "0db20a0d-736a-489f-b30e-c99dd0b2b36f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706853117, "uuid": "5dd6b167-d89c-48af-86c6-f7850d3d9aca", "value": "Cqqjbi.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8698412e-c214-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706910390, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706910390, "uuid": "7144a3d7-8730-4859-98d0-1b1c3a419153", "comment": "Malware payload", "value": "0e9e28eccb5d8f7e2820d496d9392875", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706910390, "uuid": "5e2a5ec3-afdd-497d-b00e-afdab3ed9d3d", "comment": "Malware payload", "value": "334af40ee6d2b1ce196a201fc4a326e2a9d03b8e88cdbaecedceed180068bbb7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706910390, "uuid": "71e3aacb-9329-40d5-aed6-456a6f411814", "comment": "Malware payload", "value": "1af3a169a980ab654593225450e2582ab8bd133f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706910390, "uuid": "ba0b1c6f-1bf4-4ea7-a6bd-887fe308d5be", "comment": "Malware payload", "value": "4471331839f0c42c1660a6cc8dfc55d541cae4c2d24085130717b1f6288bd83f359190ce43124beeef8dcba5ed232c54", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706910390, "uuid": "563f68a7-e361-47fc-9afd-d4d9abdf8dcf", "value": "T1A0E733675A39C3E2F277AFBA14B2E6F441410E2C6447E0CA5B9F3D4CED765E52A010B8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706910390, "uuid": "6d2fd6be-0550-48fc-8bb6-53ce13301df8", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706910390, "uuid": "fd4dcf0b-047c-4132-93ae-68a8da635449", "value": "1572864:5BCzXc82wodRGp8Cj6sYSC6M9riW9HGaM0Dht9C4K3UQ0qJIPj:rCzsOoDGp8sYDtjHdMGht92kQ3K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706910390, "uuid": "85b49b50-0ca7-4f2a-b165-43b7ff120b4c", "value": 66626992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706910390, "uuid": "649573bb-7ef8-4281-bf39-358459418fad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706910390, "uuid": "9ddcde34-85a0-4cbc-9590-7a4fc4bebd49", "value": "SecuriteInfo.com.BScope.Adware.Softcnapp.11079.1089", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "381e60c2-c17a-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706844116, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706844116, "uuid": "a99942e9-3344-4279-914e-0f234f07479c", "comment": "Malware payload", "value": "583fe30ce747746bf3dab40b0bebc1ba", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706844116, "uuid": "3c66c81a-ee23-400b-afc7-0cd8700cb0b4", "comment": "Malware payload", "value": "33a6577691eebc23093ba232c678784d6ca10eee1e20aa14abf6b01648968655", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706844116, "uuid": "23ebf618-1cea-47ba-92e4-032c9020eeb7", "comment": "Malware payload", "value": "5de7eb9b21ad7d1153c6829d30095bc031b87a4c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706844116, "uuid": "6b797612-b05c-4690-9a50-87ff9d5c3ae6", "comment": "Malware payload", "value": "c4769606fb0517c744d6a35d7d5d29cdff960f46297e14f728ab13ee77a34398c83a0a23f687d50159f6cf4124bb6048", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706844116, "uuid": "b8aae8a2-0316-470e-a695-21dee2025ba0", "value": "T136F5BE2D7500F1B3E152C1B0AAAEA6594778AE34D76910DFF3C83E2E59715C21E3F21A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706844116, "uuid": "5d2bf012-438d-410f-a8f8-b914ab9fa605", "value": "e1a31a6a9fc27fd6027fcca01fd05fdf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706844116, "uuid": "f94ec557-0657-4c61-8fae-4c0aa57292ea", "value": "49152:5Za5oSmcW+GkQI4ebI/7JHWToS/RR3I9PdZr6jPOGkRYu1m6qc0DQ8UoUmhUp9X:5kmzmJbIzJH+RR3FjCRYuMc08iUL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706844116, "uuid": "a7b37861-c5e4-4991-8a43-50591c23bc6b", "value": 3459400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706844116, "uuid": "f654f30b-88c8-418b-81b5-94bf355c89b5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706844116, "uuid": "f983aea1-d5dd-436a-868b-c752aaf7fe03", "value": "SecuriteInfo.com.PUA.Hudun.465.30386", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e491465-c1b6-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706869843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706869843, "uuid": "6b2f11f2-a04a-48bc-a1ae-f361d3204f5e", "comment": "Malware payload", "value": "c147d30b7c3042ff38d722775cd5c62c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706869843, "uuid": "1d247981-e116-470a-91de-32bda49fa7db", "comment": "Malware payload", "value": "34c9f3d0e2c4772ca97819e9080dcb10673790f7b3778a598118dfd141fd14e2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706869843, "uuid": "21ffd80b-212c-4cd9-a889-f6d766c57c8e", "comment": "Malware payload", "value": "d1b874b9d1991f9a05c31187f501db1a8ec6205f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706869843, "uuid": "d30f3b50-8a8e-4b3d-ac0e-63d5780c1145", "comment": "Malware payload", "value": "9a2dfc79fc6230190ac24e0dd0d27c8ff346f8f7cfdc97b4790a84a3e7cd7b5dc4a5b6fd55836bf536ee8b5cf3361fb3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706869843, "uuid": "f94f1cdb-6700-4fa0-845d-d9add430326f", "value": "T1B1D5AE2336D1D07AC5230235F7CEB365B2BCBE701B35468763996A2E3DB15836D29623", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706869843, "uuid": "13da7384-4f7f-4648-b5e3-c690f039106c", "value": "2f03f26dda2b3e386443dcc7b75fcfd2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706869843, "uuid": "a9a17ce8-c08e-4c71-9f93-3f116d83596e", "value": "49152:mjiq48/cZP1WjV4PJeIv0WVXxcWDMtnlP50s/HySLT9/dnu0AgBJSAr2W:Giq48/WNWjV4Phv0wXDOP50s/HyUuJy9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706869843, "uuid": "2c9f9406-9fe0-4eab-86e1-00af6fc85b37", "value": 2926024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706869843, "uuid": "f836d59e-f633-465a-b7e9-c9cdded66680", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706869843, "uuid": "28a80ab4-4b6e-4535-b8b7-23adcef8563a", "value": "SecuriteInfo.com.BScope.Trojan.Wacatac.21575.12566", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f03a4579-c1b3-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1706868906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706868906, "uuid": "aff3d11d-b4c4-453c-8f9a-461a00f2d0e9", "comment": "Malware payload (Mirai)", "value": "c2ff3421de769029877643bab630a932", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706868906, "uuid": "81141164-7afb-48d6-a5e4-1831f691eb13", "comment": "Malware payload (Mirai)", "value": "34e979d730344ed2dce2cae81a6ae4c875d7f6fb8d49b6cd5309364dfd1f7d50", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706868906, "uuid": "01ce66ce-bf53-457b-8f6c-dd423c6cd38d", "comment": "Malware payload (Mirai)", "value": "81136ebbdda3ecc9333e3568cf04527867a94832", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706868906, "uuid": "973b023b-6c9f-43a4-8773-b145da0b373a", "comment": "Malware payload (Mirai)", "value": "9b0860b04a7cac015ca91dcea39c78fdf7b04369e4c385fde3aa7e210181322415b41767cc2ec1d7e7b2a7d2eb92c470", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706868906, "uuid": "28b75a46-ea09-43e1-a5d7-195b4114baa7", "value": "T1C7134BC4D983E2F8FC1213380477F77ABB72A8AE1175CB93D758A435D6527109A27A8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706868906, "uuid": "89eca357-02e5-4ccf-8426-156bfd68cee1", "value": "768:JcHCvheV99DnS3BjzjiIp6kAKgcKoLIC878SzYIJ:JcH0eV99DSRJpgKgcTLIp8SzY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706868906, "uuid": "178c8c50-b5dc-4511-8c1d-cacba4c726fb", "value": 42544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706868906, "uuid": "e3fb8cc4-b83a-431f-bef9-cebb3de0a47f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706868906, "uuid": "320cf8b4-c66a-4054-886f-70460471bffa", "value": "c2ff3421de769029877643bab630a932", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b2d66a3-c1e5-11ee-b7ea-42010a9c0006", "comment": "Malware payload (njrat)", "timestamp": 1706890212, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706890212, "uuid": "6ab07136-bdba-4e3e-ae24-d0cf06115383", "comment": "Malware payload (njrat)", "value": "b747c6b460e7889f3749558f5ff1de40", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706890212, "uuid": "992a5b1a-e6bc-4d42-b6ae-cc3a5c8170a3", "comment": "Malware payload (njrat)", "value": "353997f259516820edcbc36cca00b2cef38392d772590000178f15e048d5283c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706890212, "uuid": "8d0fd34a-e61d-4d3e-ac7e-4ddbc5200dc5", "comment": "Malware payload (njrat)", "value": "0429b693074333b3868999bf729de51b4a99e9fd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706890212, "uuid": "5785919f-fe6b-417a-a2b6-0edb4c93066b", "comment": "Malware payload (njrat)", "value": "a9a6b12cc812939bd8b466fb5d4827300f48564129fa934431cdfedf03cc0a19d726ef4da8e02c224432ee73fddc530c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706890212, "uuid": "0793eb1a-9980-4fcd-9d3c-c92c555f9426", "value": "T1F2032A4D7FE18568C5FD067B06B2D412077AE04B6E23DA1E8EF164AA37636C18F50AF1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706890212, "uuid": "e4a226f0-e6ef-40ec-a406-aa739541cc68", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706890212, "uuid": "76897b11-f475-4a10-ad4d-45a229bd4466", "value": "384:9niFqiUF54NLHdayszHdiPZDs2+TZrAF+rMRTyN/0L+EcoinblneHQM3epzXtNC+:8PZdJszHdiRV+NrM+rMRa8Nu7/t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706890212, "uuid": "f2d7553b-09d2-43aa-811f-6436f41dc912", "value": 37888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706890212, "uuid": "02270ca8-e538-43cc-96f6-a028dfdc9896", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706890212, "uuid": "72024c99-d33d-4e27-a0c0-a3e4af0b3835", "value": "b747c6b460e7889f3749558f5ff1de40.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3bb99e4a-c17a-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706844122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706844122, "uuid": "959e1030-736e-4269-a3a4-fbb4b92dc17d", "comment": "Malware payload", "value": "49c2f6fa67c7eacefe6108c3a8ab528c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706844122, "uuid": "535a4f11-c7cb-4762-bf23-31ccc19d1733", "comment": "Malware payload", "value": "35437eae52cfb2999b0d43fd8a092e1383975e19bbfb88adffb87362c4811444", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706844122, "uuid": "94620927-02b1-4164-80b9-f4f14a17772a", "comment": "Malware payload", "value": "ed4d4ce16dc3e4cb0b9e07786b0048edadd34e4e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706844122, "uuid": "f16909a0-fdd0-43ce-addd-df68b0d246eb", "comment": "Malware payload", "value": "d3b6eb3f58762421ebfac77f1f15b9e2c256bfcf5f01c2cc40c125d5a2013b21f1bd301fef454c115a2812f7fb03eb5f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706844122, "uuid": "e729be6d-c6a8-48e8-bcc9-31914533c196", "value": "T1C245BF02BE9340F3C215553024A7173ADA3BCA664F91ABC3F764DE6CED322919D6F11A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706844122, "uuid": "ec6ed215-37fc-4d6d-8f48-c125b413a34f", "value": "cbed4e582c938afffc5eed771e69ea4b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706844122, "uuid": "452e871f-8555-4243-9bc7-3c8c78a7b4ab", "value": "24576:X2GzfrvoKANKFg/RQWfxkxoJHexsoh/lhJgew:XrAKbWfs1h/bq9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706844122, "uuid": "06d32660-0b46-4ee6-b55a-eaca9aeb6f39", "value": 1187840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706844122, "uuid": "42db06c7-c663-4c17-8112-9c2dd59ec15e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706844122, "uuid": "ab3e4c67-e292-446c-85bb-f35073602a19", "value": "SecuriteInfo.com.Win32.Evo-gen.19849.16517", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce8eec2c-c209-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706905787, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706905787, "uuid": "e3e96825-ddf1-4097-af8a-75baf888e00f", "comment": "Malware payload", "value": "1fbc4099517fbf704994655bbc6fca6b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706905787, "uuid": "54f19772-f375-46d8-be9c-e166817c1a4d", "comment": "Malware payload", "value": "354bc878ea1a68a6f31a5b18974b2f6b423f6e44df7b4a80f5037209523377d8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706905787, "uuid": "3e46827d-e8fe-4f37-a598-ad0fbaf70d76", "comment": "Malware payload", "value": "2e26c404b54264e4fe606217592b3735b370e7c4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706905787, "uuid": "6cc044e6-bbb6-4453-a38c-695694e4a5c7", "comment": "Malware payload", "value": "27c931fb5072428cc294c7879bc827e1a370eb4fa653bcabfaca9a3b94b97cac09d3a56900e760168efa8b28f6c4d958", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706905787, "uuid": "be6f0a97-bcb9-4433-8afd-451babdd1828", "value": "T1478523278296F418C011D97AEC28EEE075193E577D4A6F723F249FAC92391DD9A233C1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706905787, "uuid": "99547f63-8a07-458c-abf1-ca282bb27ff8", "value": "3522b9bc4745e0c9ba72665f520a6966", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706905787, "uuid": "c3a1ccbe-897b-4745-a207-fdf66707fc6d", "value": "49152:70XvXU48Hmiy76POtjexzgw8gDwOQQ6Q4P3:gkHmrmP+Czg3gDwOQQ6Qo3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706905787, "uuid": "c8b044cf-5543-4bbb-9128-b886459b2242", "value": 1729408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706905787, "uuid": "d61b8396-2935-44ca-b318-eedad704efb1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706905787, "uuid": "c3d7c680-04af-4e13-ae42-d8554a8c842b", "value": "SecuriteInfo.com.Win32.TrojanX-gen.30835.26870", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "360a79cf-c201-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Vidar)", "timestamp": 1706902095, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706902095, "uuid": "827e792f-890c-4d02-97ba-e207486cbcd2", "comment": "Malware payload (Vidar)", "value": "6c27671c273413f04743e056daad99d5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706902095, "uuid": "24ac2a8d-6213-4fde-9560-a7808217f975", "comment": "Malware payload (Vidar)", "value": "35705327307f196cdfb3ae15953559e0d2d19323d154249d39bca1c0bab28666", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706902095, "uuid": "d33ebadf-8bf4-4efe-95ea-36e502ee78b9", "comment": "Malware payload (Vidar)", "value": "d0c966857ab0a58c43bb0571f17b779a4bac6d1f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706902095, "uuid": "21f1db42-2f2f-4a30-8956-acc2f58e64d9", "comment": "Malware payload (Vidar)", "value": "d39380bc0e2a1be8b51ddfac6fb30ea25122b1bde83ef8e4cdc133447237e44e815e421e7f87d201b31f0538c49fae8d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706902095, "uuid": "ac28fe0e-0d5f-49a8-8aa9-5cbc278eb917", "value": "T146F10804FFF8573AFABF027518F31320A675E3821966C71FA8C4165A7E151C9C653AE1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706902095, "uuid": "1736df9d-70ee-488f-a49c-5af7350c0ccf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706902095, "uuid": "b4fe1b1b-bd2a-490d-bcc4-8c4ec73dcf49", "value": "96:zj9h3ZoVMD5J/QKe7RDHComDec6THR58lkwWiev4giDQV/XdLd0zNt:VhuW//QKac6THf8SscV/XxM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706902095, "uuid": "39e3050b-5aac-486c-9e0b-85c00e7dd28b", "value": 8192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706902095, "uuid": "ab72e8a4-6433-4805-a164-cea6ff9905b0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706902095, "uuid": "85a01a3f-8b1e-4a70-853e-dd6b80c84c64", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25c954ec-c20a-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1706905933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706905933, "uuid": "e6b43398-f997-4603-812d-051fcf2a9861", "comment": "Malware payload (RemcosRAT)", "value": "8bcfa45995fd6641dabf5ee53fea3524", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706905933, "uuid": "095ef30e-cc3a-412c-8298-dfce0dbf9426", "comment": "Malware payload (RemcosRAT)", "value": "36b3b7fcbc48c6dbf0c3d1692e8f0f0296072f5d0d840ab69d4d95539493af98", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706905933, "uuid": "f3001598-aa1d-4e43-8248-f2c394014f34", "comment": "Malware payload (RemcosRAT)", "value": "e6646a8e9cd1787a08db997ee20a06bf553a3fdd", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706905933, "uuid": "fa897fa8-8777-481c-9eaf-e1184c51fc01", "comment": "Malware payload (RemcosRAT)", "value": "0557a8686928f9497098a9420385912d694bf6b70a7502cffe950839b2caccc3476ef4e6f43b1e47b98ec6666f62a5b8", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706905933, "uuid": "5127b698-df28-4b75-95d2-adfbccf454e7", "value": "T173C38E337B42BEE52FBB2E40F41128E14D54B52B27A01998FFC41C85AEFB050DE995D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706905933, "uuid": "09fa5817-0503-4a78-849a-160cef1d0c74", "value": "3072:XjH+8fLmI2J8nk8ZOX7X5QfHmvJevp0kdBG4dmNuwzfc5CWwhjC:XjH+8fLqJ8nk8ZOX70HMm0kdBG4d7KGZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706905933, "uuid": "8ef4d4ef-3a1c-47b1-9b76-d92646ff7a21", "value": 118939, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706905933, "uuid": "347e50ce-bc0d-499e-acee-4859d6d7a0e6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706905933, "uuid": "12246942-c3f9-439f-b736-8900090a7cfb", "value": "PO - Quote_0093223001.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b688f784-c1fc-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RiseProStealer)", "timestamp": 1706900163, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706900163, "uuid": "2d9d3d65-d9d6-4cab-8b1a-a01f38e5f080", "comment": "Malware payload (RiseProStealer)", "value": "5ab5b8808716089370312d02b94dca34", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706900163, "uuid": "56ccc227-1314-4164-af7f-f76cb0403969", "comment": "Malware payload (RiseProStealer)", "value": "39373218987192dc12b52c5500039229150dc91434c1e42cd2a37b14725e9391", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706900163, "uuid": "232c39c4-7152-4f12-9420-f1ab2551c8f4", "comment": "Malware payload (RiseProStealer)", "value": "5cc95f6c59c25396f3f97ca224b88a32a317a984", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706900163, "uuid": "b6e23427-cfbc-4fe4-ab39-33552c464b64", "comment": "Malware payload (RiseProStealer)", "value": "e43b91159e55ca8202a7dae0220315a06fee892a6737492efb3c56b269de0aabe8dce4c179a2a46181f1a2e4f60cb072", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706900163, "uuid": "18ef3c24-bf5f-4658-a37b-bd73f373efa3", "value": "T1A7B533F2487374A5C61B177C5616A9219A7FAC43476C800DB810FE6AABFF231D271EC5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706900163, "uuid": "4ba05df8-94fe-40ca-9d4b-de1a4e213fc8", "value": "baa93d47220682c04d92f7797d9224ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706900163, "uuid": "60123670-fc0b-43fc-ae34-fe80a6c9317c", "value": "49152:U25He9297d0vHI8NF0hceyP+SnX/yJby7mr5fenIFY0k1EJcHeWOv:JHZ97I/obyKtej76jBv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706900163, "uuid": "b219f82d-38f3-46c2-8bf6-ed8e0f970608", "value": 2302976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706900163, "uuid": "a7a988e7-4dc6-49f9-b1be-f47727b7049f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706900163, "uuid": "890b851b-2ffe-41b6-a268-5d738a9096f2", "value": "5ab5b8808716089370312d02b94dca34", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f486c38-c15f-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706832451, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706832451, "uuid": "9bf63e3c-855c-4f94-993b-b8634de4176d", "comment": "Malware payload", "value": "ce588fbb745992adf637104433d1143c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706832451, "uuid": "3ebb5f18-8ea2-4aad-bf3d-643035de65cb", "comment": "Malware payload", "value": "39ec44873fbcf6ec0d024ab87aace4c377a53f7f76e1d5815f2c6ad5b4bc4ee1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706832451, "uuid": "0764ead2-0800-4046-a15a-294a30c331f4", "comment": "Malware payload", "value": "9be5de1b898faa9c11c744837719cf894ef422b1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706832451, "uuid": "3a56168d-87c6-437d-b458-6cc254160646", "comment": "Malware payload", "value": "b6efb40658141e67a7511b79456615298f86839cc8507ac8a099ecdedb4a95d9d08b7e468d2253905c1df0bf9dc65b08", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706832451, "uuid": "0d7e5aa6-87b0-4e09-8015-346ecd4f1136", "value": "T148F56BC6BC9041E5C4AEE33A88669895BA31BC480F3077D73A90BE7D2E367D49D75348", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706832451, "uuid": "4051cc6f-80e1-459a-9420-db9d9a19df37", "value": "5929190c8765f5bc37b052ab5c6c53e7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706832451, "uuid": "2b3b199a-6a7a-45f9-9308-7b08df98051b", "value": "49152:43DH7IvbEQzyuljaR/RjJl+dkCSuKZXC44cTT:waAQugGR/XZJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706832451, "uuid": "bfa362b4-b800-438b-95fd-7f9e56757d1c", "value": 3356160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706832451, "uuid": "34bf8647-bb28-4038-8df5-64795a7cbb38", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706832451, "uuid": "403cd77a-11f6-4013-92da-ddbbf07a6974", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e2738bd-c1e7-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RiseProStealer)", "timestamp": 1706891076, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706891076, "uuid": "5244db01-9a55-4105-bd7a-61c60528c059", "comment": "Malware payload (RiseProStealer)", "value": "90a5eb29532a722693b5e42b92e4e913", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706891076, "uuid": "7f98372c-a8a9-4e78-b9d6-b0ef17a0dbd1", "comment": "Malware payload (RiseProStealer)", "value": "3a3490f08a118f2e2c927e3458c6d0251773127c7a03060067f79298f4a28906", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706891076, "uuid": "b62790f9-8fcc-46b6-b223-73ca9b2d1033", "comment": "Malware payload (RiseProStealer)", "value": "947fea3321f460a6ae04a88c002e166e070bf0ab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706891076, "uuid": "ce02520a-0d17-422c-8671-bc57148204fb", "comment": "Malware payload (RiseProStealer)", "value": "1e3d9b7b0803fcf966117dd829d0f76a2bd5dd5fde6b38704c8e8f3d66dc371b655142a034aa3c9704e2edb474e2e8ba", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706891076, "uuid": "fa01a71a-ec8a-4568-8b70-6ab43c8fd888", "value": "T135B533FEEE755243DA032B3982AC469500836C5BDA81DC3ACD74F6178BFC936E149D25", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706891076, "uuid": "138e178b-2815-45f4-a899-aaf67ee6d2e2", "value": "baa93d47220682c04d92f7797d9224ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706891076, "uuid": "288e2101-19b9-4151-ac89-0ca78b05a192", "value": "49152:eXF6KJqJaBV4MDPQaXHxp+OcphfwX+EoSE9Krk4OiZ4MPoaLJ2TA:eXF6QqJaDXPQ2Hf+l/fVEfqKr3OilHJa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706891076, "uuid": "35c0261d-be2d-4c48-b4fc-93f8abdf6e13", "value": 2290688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706891076, "uuid": "44ebab66-ae3f-4687-b34b-0386eb576d2d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706891076, "uuid": "291d76ae-a9cb-4457-a627-a87a769d174b", "value": "SecuriteInfo.com.Win32.TrojanX-gen.31721.25602", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ddde58d-c164-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1706834650, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706834650, "uuid": "21e9ae05-dc0c-41f7-922a-afd0c02c3219", "comment": "Malware payload (Mirai)", "value": "eed82ecb5827c9aa057e4324c17f1705", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706834650, "uuid": "f22614e8-85df-4d99-b758-e3b5de01d909", "comment": "Malware payload (Mirai)", "value": "3abe4137291b0126db1da3a6ae3c6f7385572ba2313762d77fdeb86a0c0fa5b6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706834650, "uuid": "b6f4a40c-e5d9-4e86-a9f5-52089b621e09", "comment": "Malware payload (Mirai)", "value": "9eab04daeca870ebcc46c8df6d75e506f85d91ae", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706834650, "uuid": "ef0872ae-966a-490e-a96a-9c0a21034860", "comment": "Malware payload (Mirai)", "value": "aebc1651e755fa1ec404b153acbcd1310f2559592dd8ed796f7ef2feb542277eec361fdbe443996c370345ccbacfe7e8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706834650, "uuid": "fa6aa629-24db-4a11-bac7-4bd2c19d3e98", "value": "T151534E96B401AD3CFC5BEABD40165A19FA313B3016A30F5B9BA7FC839C321A6DD16D41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706834650, "uuid": "7b5d8556-d91b-442a-8ba5-637bee90120c", "value": "768:neT+6JhUvtNaEVG1xPgj2x9+iGCvYN1ul8yXLyCIlqXxXv2XWFbN:nInQvtNFG1xIjeWvNUl8yXx2qBvyiN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706834650, "uuid": "6c5643b1-075c-499b-8842-7561f9175b08", "value": 61432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706834650, "uuid": "87fc11d9-ffca-47ea-8a29-ae019ecd49c2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706834650, "uuid": "39ba5df5-ce47-4521-9b37-43be7992d016", "value": "eed82ecb5827c9aa057e4324c17f1705", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9273c858-c18c-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1706851999, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706851999, "uuid": "551d1f37-407a-43cc-a47d-347fbc14f1a8", "comment": "Malware payload (Mirai)", "value": "73496a8b42e3064a6057779a513273a1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706851999, "uuid": "b76f39c8-8f0c-4327-92e2-8538c9d85d2b", "comment": "Malware payload (Mirai)", "value": "3df4d63dcc40f1b0e12ebd28bb09cb9eb52c757751d5941653c346586b9e0713", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706851999, "uuid": "89ea4bc0-ef85-483d-8503-75f06fa4315c", "comment": "Malware payload (Mirai)", "value": "17ad0f5cc44e18538f30446d795f0e68cd31f82d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706851999, "uuid": "ec0b539b-2235-4edf-8402-51ee35255519", "comment": "Malware payload (Mirai)", "value": "fb64133c7a7263d2b4b2b7edbacce2e29a12e7e4a620372a64f1f13892da6460b4e585914d084fc849766c7ddcaa2da4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706851999, "uuid": "d58193f2-3e6d-4956-ac65-22d2f624802c", "value": "T1F8F34AD7F900DEBDF40AE33B48130909B130B7E151921A376297797BEC3A1E91967E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706851999, "uuid": "b5d3a197-f48a-49e2-ba69-7719d49755ff", "value": "3072:Wp+AfUWxqkvjdD5vvtK9l0I3hS+DbvhuVrjbiqLSryvUzym+uo9f:k+jQpBWX0IxSivhsLSr0qymDoR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706851999, "uuid": "d33aec1a-3919-4e31-8279-ca41e8025761", "value": 165984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706851999, "uuid": "3842cf67-d77e-498c-9b66-4ef229e5c54d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706851999, "uuid": "007aff18-8e6c-4e9a-8052-252926849a04", "value": "73496a8b42e3064a6057779a513273a1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ebac34c-c19f-11ee-b7ea-42010a9c0006", "comment": "Malware payload (PureLogStealer)", "timestamp": 1706860099, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706860099, "uuid": "0072a9f1-a36d-4a1f-81f1-128005d43894", "comment": "Malware payload (PureLogStealer)", "value": "718cd67055404449d17886f2ce00d000", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706860099, "uuid": "3b0649ec-ff47-4294-af16-c6238b0c21ba", "comment": "Malware payload (PureLogStealer)", "value": "3ea425218d988204c94ac887444ec6ff88d9161522399a09c00ef8c5f52eddb8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706860099, "uuid": "d1265e74-ecd0-4c4c-8d39-579651012f6c", "comment": "Malware payload (PureLogStealer)", "value": "40d5cb89e51df88b993c85fdfcd574583d5d6dee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706860099, "uuid": "81b1d870-fa85-4b47-8ed5-569b2e72e787", "comment": "Malware payload (PureLogStealer)", "value": "7ab6f5837070197f1e8b53dcb0232ed01021aeb18b0141bc7a0ddfb5da8e0e49f3e2f6c82deb3d1f1a39c5dfa929dad8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706860099, "uuid": "7770e965-e493-413c-b287-d824855db77f", "value": "T1754523806E94DD45C8DF89F704FE97619B229916E798C352E4ADB6480F327EE4007AF3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706860099, "uuid": "59f2d48c-cb61-47b8-893a-fc9954f7bcc3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706860099, "uuid": "c4cc07ef-d78e-4f71-8688-3259dcd7e08b", "value": "24576:cRrGu4vgZ/NesmI/9ZELwPPROZVpB6JvUtj6qb:YG5eNesD9yL8QjH6Jvo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706860099, "uuid": "fb8a7a9b-4eae-4a11-a714-3dd56fedf6d5", "value": 1268224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706860099, "uuid": "b071b163-6d06-440f-8d3f-b757bd81c2e3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706860099, "uuid": "372f7b7b-676b-476a-8cef-82339e3d6af9", "value": "Runner.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30c05ed9-c18b-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706851405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706851405, "uuid": "cc795933-3ad8-4153-9f0e-358990160caf", "comment": "Malware payload", "value": "13448ac818208d59649829a48fb7fcac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706851405, "uuid": "2eda72b7-dc86-472d-8ede-a831533b3b64", "comment": "Malware payload", "value": "3fd224cfa33214333b06b6c64a78d86f7454941162577e994fec7819f0dfbcf0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706851405, "uuid": "535a58c9-8111-4f27-ba79-7c15216a2c0d", "comment": "Malware payload", "value": "c387143b5a33cc2c6b2e7eb8dfae4867d854c99d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706851405, "uuid": "d7a3c2ab-7bc8-4f16-b9e1-79b413a48037", "comment": "Malware payload", "value": "0cf9cbe255a1b634a7e2ecbae8adc4abba5f47dc29487c2dd532121cb9bde44b106d037cffa42295754f1cfced806fda", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706851405, "uuid": "89b4d649-89d4-46d4-807d-48e6a4cb2850", "value": "T15AF29D6636D1D4B7E59346B21EB7E7BAD3B6E7000135468B2F500FBA39351C38D1A283", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706851405, "uuid": "e279bfc6-b125-4a50-a49b-45359b738f7b", "value": "4f67aeda01a0484282e8c59006b0b352", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706851405, "uuid": "069bf33d-e63e-4ae6-868c-cb8301f03c03", "value": "768:0RlPzMJWjbJQq2gp4yEGhEw8TmBI287tTMo3fodkc/bCM:KPzUmdx2gahvwVBW7rfoOc/bCM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706851405, "uuid": "c4bd8889-411f-4347-9f0c-f98ac0fc872d", "value": 34851, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706851405, "uuid": "c20d2939-98f0-428a-8078-3a2aa200b63c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706851405, "uuid": "971cb147-7ba9-4a5e-9361-e008ba563d43", "value": "SecuriteInfo.com.Trojan.Win32.Rozena.25975.17244", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1e44f1a-c1dc-11ee-b7ea-42010a9c0006", "comment": "Malware payload (IRATA)", "timestamp": 1706886465, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706886465, "uuid": "6d98f96e-a253-4f53-bbfe-84b07b144976", "comment": "Malware payload (IRATA)", "value": "f9796653a3b7e7296753c5ad00aaceb3", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706886465, "uuid": "58c57f04-55c8-4ad6-a883-e840f9a87af5", "comment": "Malware payload (IRATA)", "value": "4038727ee7feec9deb2dfc24d23729e95f9268112ec32da79572e5e4061689b0", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706886465, "uuid": "f5fd878f-484b-4e7e-8a72-22769d50acdc", "comment": "Malware payload (IRATA)", "value": "a9f7b35c4834351030660590d067ce1d41bf1fdf", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706886465, "uuid": "b23c0977-7dfb-49a0-b428-546a4e77ed84", "comment": "Malware payload (IRATA)", "value": "a8c0e4ccd2fc0d490f2922f29af6bf367b98d7a835a3da7740c7d71339cbaa0ee7c58633d3dc4b8ad1a680d3a6045527", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706886465, "uuid": "c970b755-19bd-4cc2-84c3-83aef2151331", "value": "T1E4851243F26AAD6BC835C03326562B36611B5D18CD42F74A294473FE68BBDE84FC46D8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706886465, "uuid": "eb6b4734-3bf3-46ca-9864-830325f27444", "value": "49152:EMglMw3iKuK2/LjPTSREey7Ah0InjH/aK9X0AO7sNkk0T:EMgl5hZEbqEeJh7jH/z9Xtkk0T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706886465, "uuid": "4249f794-7f0c-4ff1-bef7-b38b38dabd91", "value": 1786296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706886465, "uuid": "ccc28816-8565-46c7-a4f8-740ec4a292bc", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706886465, "uuid": "75cedf17-38b9-49b2-bf15-54c2fb53c708", "value": "adl.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0dd5fafd-c1a4-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RiseProStealer)", "timestamp": 1706862084, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706862084, "uuid": "4f943219-7fee-44bd-9fbc-979b3a555bba", "comment": "Malware payload (RiseProStealer)", "value": "a8f9a3d72dfd1192649fa363a3bf3eb9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706862084, "uuid": "8fb6b4c6-3232-418d-9aee-38111503a025", "comment": "Malware payload (RiseProStealer)", "value": "4408830bde52b2ff80b24a7fcbd5925bd2000013892d39c61342512e0cf2edc5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706862084, "uuid": "29e3dd6f-48aa-41f2-96ca-d5604bf0311f", "comment": "Malware payload (RiseProStealer)", "value": "327ea9c1c882ed15293a3d580db05ba577d79aed", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706862084, "uuid": "02524488-0037-4e8a-87a7-f8061b102647", "comment": "Malware payload (RiseProStealer)", "value": "6f177386844842d461f53ffdc05d77d98653c9a745c3b607dc4c5971ef5df2cc593b2cb9bc3361372f68eb932dca12d2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706862084, "uuid": "98fd502c-3ad7-4d0e-a762-c5c4de7943ce", "value": "T11E5633123DC092ACC05D45708A17BE3E7AB62D7B0D7D5E586ED82BDA5CF36BD8138842", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706862084, "uuid": "c089c42a-da75-4138-b548-59e0f97a1c80", "value": "4329a5a28af84abf208d95062e79baad", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706862084, "uuid": "758cfd5e-0d44-4ce0-99b3-112769301b21", "value": "98304:7OZOwTH4GKEybELxI2gsoESFkjSfGcEuFaa7tUbbkn4XmmdX8yUktR1IxFLwt2yi:74TH43EAELxI2gsoEXuFaaJxn42mK6Wx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706862084, "uuid": "84d876e2-5519-401c-814c-61d326f1cad4", "value": 6244440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706862084, "uuid": "eab9d53b-c557-435e-85fd-16cf3901f5c9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706862084, "uuid": "82a0a9cd-1de4-4432-9b2d-0dd249a7170a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abd5c85e-c1c8-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1706877811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706877811, "uuid": "8565662c-de20-4b47-978c-9d32f991dcff", "comment": "Malware payload (Mirai)", "value": "bc9c26f18401d38362e07e2e27690e13", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706877811, "uuid": "b59179b0-22b6-4db9-aa8b-36a9d05ea621", "comment": "Malware payload (Mirai)", "value": "4779d634d6ee676b2adc92cf48e2fd70efe2a2e3a75fa0d0ce856866e22012bd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706877811, "uuid": "df82da87-21a7-4c8f-8fdd-3ccc372b5ff2", "comment": "Malware payload (Mirai)", "value": "4e0cb38f9ccf848411167388bb74cca586762e74", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706877811, "uuid": "bb7a7c44-3aa0-4462-b868-cab2577904d2", "comment": "Malware payload (Mirai)", "value": "c2771c367ec005506478336b854881a2b1e7cdd5647dfa697f730c90aeb469046cb918013eb4bc72a867c78749ebfd08", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706877811, "uuid": "813466b5-3877-4e66-939a-ab65367c6139", "value": "T179D3F946BD518F17C5C321F7FBDE029C7B266F69D6FA3102A9247FA037864D60A36211", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706877811, "uuid": "a00b114c-47c7-4b71-84c7-454a00db80d8", "value": "1536:iROMYdMA2rc3kJiidfaQHcCmnnG4oK7awfr9q7OU+DqCDnDOKlcEP38a+3plflaB:CY8rcerHcCmnlNawki7DqKaa+5iRT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706877811, "uuid": "6c0bd624-c8a7-4fc4-9a64-3bde65dae89e", "value": 130732, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706877811, "uuid": "a56afbe1-b890-461f-926b-655ecd758e8e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706877811, "uuid": "2c6cc29e-e5eb-433f-a1cb-af7c39b73969", "value": "SecuriteInfo.com.Trojan.Linux.Agent.13329.11633", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbe16971-c1dc-11ee-b7ea-42010a9c0006", "comment": "Malware payload (IRATA)", "timestamp": 1706886428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706886428, "uuid": "4c5dc460-92a2-4ff8-9370-666b1eb80ae5", "comment": "Malware payload (IRATA)", "value": "a82078cdea67816c740d7a595fe4a3ee", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706886428, "uuid": "ab4a6d02-e5a3-492f-926d-be9311e6b12b", "comment": "Malware payload (IRATA)", "value": "4823399b49038d5673c8cd066aa576b705ce2df10c393bbc56df293cd8101a96", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706886428, "uuid": "1007b398-c457-4f58-8725-428d3ed81835", "comment": "Malware payload (IRATA)", "value": "f32ebbbf112252209947f1a55a70c889ee951e01", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706886428, "uuid": "d75262ba-da7e-4f72-be5a-8db9f3dad96d", "comment": "Malware payload (IRATA)", "value": "cf141c1c92cd433633a4b9c7a0b02dca0895f5d10788abbd2bc660eaa674a79bff3ef3fdc8ff37ccd28103fc4b6c61f1", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706886428, "uuid": "4847f093-cfb0-4ab5-9132-25b29c6376d4", "value": "T1DB951247F761AA27C8F6D33231751236507B4D29CB83B68E291977BA28F79DC0B856C0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706886428, "uuid": "8564f9c2-0162-4c67-a166-22fc3a470612", "value": "24576:7/cDcjmg6PYYI/baqqqyQgWmQhMLYg/BmiwCnQOKpXf/d7YMv2s7H/vDilUY2Fm/:7/mgWtiMEumFCiZHvJ/wUjPYuhUpAM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706886428, "uuid": "71a96c13-7c85-4ae1-94d9-1534161f0bcd", "value": 2007790, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706886428, "uuid": "38e3d4b1-0f92-475f-acf5-005a5562416c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706886428, "uuid": "a787bb96-ec85-4f2a-8b53-24b22d379d91", "value": "base.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2424ed9-c1b7-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RedLineStealer)", "timestamp": 1706870628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706870628, "uuid": "afa20e81-ec41-4b8e-b6bf-92db3eb3b669", "comment": "Malware payload (RedLineStealer)", "value": "1a5883d5da3fa0220f849e384379df0f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706870628, "uuid": "c6d2726b-a04d-4c67-b4b5-7ab5ecf3fe77", "comment": "Malware payload (RedLineStealer)", "value": "497dbb4a614374e88f3abfa43bc2ee14e0ae150f438ae8ccb81214e5430494f8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706870628, "uuid": "6ef7a4e6-015c-4b18-8178-902b6c4a9ae9", "comment": "Malware payload (RedLineStealer)", "value": "d5dca374a7ee07c10c8b34dbe1f13d978ae4ac2b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706870628, "uuid": "1c72aea3-be3f-4deb-b541-cb1151b2321c", "comment": "Malware payload (RedLineStealer)", "value": "73270f42c47cfa0e59b461ff9f991b63f4312ad8ab06221e40cad7103c4b9b27b2f4834e8bfbd138a53883c520388063", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706870628, "uuid": "2779e091-6f19-4469-917f-f5c364002959", "value": "T197B5239670C0C232C9AB513199E1C6AA5F797024477866D3B7DD26B76F107E0AB382CF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706870628, "uuid": "8978bc33-384d-4fff-a6f7-6ba695714140", "value": "bf5a4aa99e5b160f8521cadd6bfe73b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706870628, "uuid": "9ac25a27-46eb-4860-8ce4-ebf365a4084a", "value": "49152:IkQTAmo7fy3qEVME/aYAGd83eOzCMUCVlVirg0ne+RgfSUZzxJ:IamqwzSGzFCVlVqnexHP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706870628, "uuid": "a8a7a97d-bc58-4edc-98f7-4e849cc2c702", "value": 2390272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706870628, "uuid": "c84be568-0aea-4170-91bf-2290bf972d02", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706870628, "uuid": "654239f8-df2d-42ad-8c41-aa18d0302c57", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d724102b-c1ad-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1706866287, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706866287, "uuid": "a061b29b-d765-4ef0-9f6e-3c55581b182b", "comment": "Malware payload (Mirai)", "value": "f26fee0d2b7f88bd7d5aa0860756b6d5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706866287, "uuid": "0ffa237b-151a-479c-8b4e-c8472b5e4c07", "comment": "Malware payload (Mirai)", "value": "49ee7966b481548392c8e66f58b9792d09e78cff34b6a4867f522602dc4930b5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706866287, "uuid": "40daa70e-8b3e-44c7-87a6-76b654c6d979", "comment": "Malware payload (Mirai)", "value": "8e933506d7d8b9205573881947d9419ffd6e1aaa", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706866287, "uuid": "220ee640-4880-438a-95c5-1c2bc09be63c", "comment": "Malware payload (Mirai)", "value": "c10a546a4f1b84c99e976c2f311922a07970d2c3b9608b31af88b3ffc33d61c5ef247f1bfae8f4d72d672e04e314cc94", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706866287, "uuid": "77d86d31-3a2f-4af8-a856-2c4b6ec2e67f", "value": "T19B63954E6E719FBCFBAC863447B75F209248339626E1C684E15CEA011E7034E745FBA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706866287, "uuid": "4a23aefa-2a5a-474f-919a-8d543ca8db8c", "value": "1536:u8aCKglaDrIjtb3stmjpYpt13+c23mo1UQ+eX:9H+0Jb3vypt8c23mo1RHX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706866287, "uuid": "5ed2f25e-f447-41b2-815c-2a27b39e6d6e", "value": 68256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706866287, "uuid": "07b9af57-bed9-45ac-b0ad-403a4f8ca3dd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706866287, "uuid": "b1653985-2cc9-4057-8ef3-58c4150341d0", "value": "f26fee0d2b7f88bd7d5aa0860756b6d5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9853e30-c17e-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706846078, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706846078, "uuid": "e661339b-4b36-454f-a8d5-4783a9958c45", "comment": "Malware payload", "value": "7631ecba34420fc0e2ab469dfd6c597b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706846078, "uuid": "a1a8e99b-7d56-49c8-87b2-516b07a3b5ba", "comment": "Malware payload", "value": "4b3461c15cbd9050ff3133e7ad8d792745000a7831fd437beb91c6286e47a688", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706846078, "uuid": "be0805d7-73d1-474f-a683-1bf4d6385ca4", "comment": "Malware payload", "value": "166353bf482adbdf0d5edf9af8a91086b4e72cc2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706846078, "uuid": "aa90e5ce-ab02-414a-a206-47731cba43dd", "comment": "Malware payload", "value": "d606b581d1b14cdd7953960bbcfcfc39d2bc1d3fdd7cad6f92d1be67216db54fe10675cd2abfd845ea7726d1efff56e2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706846078, "uuid": "86e5a56f-3b5c-41b6-bf6b-90d82297cca5", "value": "T1ECF229D2B901ED7CF44FE73A85074A04B132B34A95832B3367B3B977AD361940976E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706846078, "uuid": "5498a765-0d76-48df-815d-d553bc6db5f9", "value": "768:96EGTFiwbP+b/H0EgG5Duj87sBjjCV30CZzLBJ2B71:961F6P0EgG5aj87sBCV30IzdC71", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706846078, "uuid": "9b61bef4-b02c-4603-b085-6f39d1ec054e", "value": 37592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706846078, "uuid": "d10c73d3-e088-4859-b5ae-e4560707235e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706846078, "uuid": "0b396499-99ea-4de7-9f8e-7ff2460b9866", "value": "7631ecba34420fc0e2ab469dfd6c597b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e775acd0-c18b-11ee-b7ea-42010a9c0006", "comment": "Malware payload (LummaStealer)", "timestamp": 1706851712, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706851712, "uuid": "d266c777-ae0d-432c-9c22-1f4d97a90a46", "comment": "Malware payload (LummaStealer)", "value": "978adeacb862253023f9c296c12ea083", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706851712, "uuid": "bf173b18-01c8-4eac-ab4e-239019e76c30", "comment": "Malware payload (LummaStealer)", "value": "4c917b7d4291d22d757f2bb707513c6e85c51fd268f1518eeba92128b1a0d673", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706851712, "uuid": "a18e0442-e711-4012-a128-a1bf6d31812e", "comment": "Malware payload (LummaStealer)", "value": "576fc339b8437045c2a34e568f2aae67f720d333", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706851712, "uuid": "9fdce906-2244-482f-b5d5-c7ab46a57bbf", "comment": "Malware payload (LummaStealer)", "value": "176b5726e578f759367f17b17b4f7366fc71e6fce60782fa67665aa068978e6fc65c6b4313fcea24c6f84280d516982b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706851712, "uuid": "8d45ee9d-920d-477f-8bc6-5451072ce611", "value": "T1D55633426EDB27E9C59E93786792FA3D77F08A6980202D0F50A41BCFF9931E56473213", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706851712, "uuid": "986dbb07-5e25-458b-9a69-a2c3f09dbc0a", "value": "365adca02beed196c4485f1cc07c6dac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706851712, "uuid": "e4f71d68-3892-4292-b53d-97f849994f14", "value": "98304:XQA6qAGUOouN4lg0oBP6d7LtAFdt0LGNtLMYXlfrXYQbOoy2bofsRtUEDGd1TdWs:gDiUNw4vmP6d7Lt5GdhrUvmoE3UkGd1V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706851712, "uuid": "1888ef09-abe6-46a8-888b-b89649c4954b", "value": 5924440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706851712, "uuid": "d8e1f23b-f4a4-4a7b-8e05-9437c458eb2e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706851712, "uuid": "dff1192c-4425-4005-80a1-109d78ba63a6", "value": "978adeacb862253023f9c296c12ea083", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "148a7ae7-c1a0-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AsyncRAT)", "timestamp": 1706860377, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706860377, "uuid": "c2ff9508-835c-49c9-849f-ac49c2300e2a", "comment": "Malware payload (AsyncRAT)", "value": "86443efb8ee2289340119b5e84aad4f1", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706860377, "uuid": "8970f344-80e2-42f1-8230-c1253d26161e", "comment": "Malware payload (AsyncRAT)", "value": "4d64bbdbca232e9efbf8770386ed39562691793c678856d6e0c0fb1dc4af5219", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706860377, "uuid": "c28d1cfc-ec00-49d8-b0bf-d69e9f993b2c", "comment": "Malware payload (AsyncRAT)", "value": "e8b2d4cc5fcebbfe798283431073e0b78ba80f4e", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706860377, "uuid": "d1a9eb0e-3df5-40b6-afa2-ec7d0c62149c", "comment": "Malware payload (AsyncRAT)", "value": "82ce9632f47ce3f998b10edbed0e6d075eb5a20baeb8d6dabb27e250ea695e987ba6c14e12ba4a27a137288dc5e012d0", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706860377, "uuid": "a22883c5-e79c-4533-b649-4d65c15935c1", "value": "T10E544BB3EAA24CD9C5A6A274AAC7C6A27539FDD44232C70B135016302F1BDD07EDD6C9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706860377, "uuid": "4b13acdc-eb2b-4a08-b151-506ac74d5975", "value": "3e4ea5a76e68c74643536824830b0523", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706860377, "uuid": "7a35ce16-7ded-4ce9-b251-cfc0bb1b88a0", "value": "6144:8Qxe2eVqrNB91UFT5uX7I6ysBVwOmfJJJ655ZZoMrF1kA/t3rrcEPPPoz:8QUH0rNBb2VsI6JBVwQrcEPPPoz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706860377, "uuid": "b9cb19de-5198-4d9d-a23b-90c0dd886bd9", "value": 293430, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706860377, "uuid": "1dba2cab-cdac-4a10-96d9-e43175d23d6b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706860377, "uuid": "f9274cee-7a28-4998-b746-925a4b00c256", "value": "86443efb8ee2289340119b5e84aad4f1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eaca8308-c18b-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1706851717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706851717, "uuid": "5ff14eb1-3b7a-42aa-b58a-f9a7ec4e91c6", "comment": "Malware payload (Mirai)", "value": "ae803e9071f30aa94af082acc5451469", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706851717, "uuid": "3b703bed-e454-4b15-b874-0675221eedf4", "comment": "Malware payload (Mirai)", "value": "4d83509bc5baa198606f604c5ec7c601ef63eb57a52dcabf108ca3b41301b118", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706851717, "uuid": "434cff38-d967-4f02-946f-350caf82e43e", "comment": "Malware payload (Mirai)", "value": "500bccff019d6bb0d5e6b7b4af41be3b5c7495a5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706851717, "uuid": "4beab074-2568-4353-ab1a-319812a814ec", "comment": "Malware payload (Mirai)", "value": "3ce17d7787bf403141294909dc2ed8069958bd2a40fd98a0359d56a30895cb82cbd798b2481fe884c560b395205ea6ab", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706851717, "uuid": "8fd995fa-e980-43fe-9f02-993003dabb9c", "value": "T18B03E884B9819A07CAD50377FA0F42CD3B256398F2DE73039D226F51279B96B0E6A506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706851717, "uuid": "2d6bf695-a68c-47e1-b0c5-111a4f03584e", "value": "768:7Ric5GwzpKBudAEhfT1gQ3cVmxwEQnh2A9INsc4:Nh1+EhZgJoaVnhhIB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706851717, "uuid": "4d17d6a3-6e06-4c35-9bbb-1272f9ecec75", "value": 38112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706851717, "uuid": "4c99854e-e4bd-47fa-9e7c-af32abee4382", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706851717, "uuid": "be3f947c-19b5-4c7d-8948-18043e76d76b", "value": "ae803e9071f30aa94af082acc5451469", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9dcb0be-c1b0-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RiseProStealer)", "timestamp": 1706867554, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706867554, "uuid": "f88cdfda-fd1e-4065-9ea7-ecb02f4f60aa", "comment": "Malware payload (RiseProStealer)", "value": "c44d70a6d94dc6790fc646cd8d5d2725", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706867554, "uuid": "23ab8391-004e-4b54-bdea-d0f2066b1d67", "comment": "Malware payload (RiseProStealer)", "value": "4dd149660cb7d1fbd994061df4399a9dec6b46374e163b085aae6bf0252fa3cd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706867554, "uuid": "d4c64b3c-213a-4d5f-b35c-cd93b8dd74d1", "comment": "Malware payload (RiseProStealer)", "value": "8534ba7cedb019ed5377ce56c7880a597785e589", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706867554, "uuid": "c2209689-9cd3-4883-9fdc-dd8762bffee1", "comment": "Malware payload (RiseProStealer)", "value": "c5077e9770ade15fba07ea90aa55d2305f8c5b952c08335593f00258d50f48d08a9fec0ec2d1ea1053981edab3531a5a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706867554, "uuid": "845650be-e4ac-4be1-a70e-dbe846db3332", "value": "T1035633427ED2655DC0D82B748583B93D39F46FAA54348E0AA4ACFBDFBC730345931992", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706867554, "uuid": "67230f2f-79ee-44c4-805f-a292e653ded7", "value": "8c65070cfe2e3948718c63a15b6b06a0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706867554, "uuid": "e81068fd-5970-4290-b69f-06e4a4a1b6c0", "value": "98304:Rgo0b2PLaFuQiI2eGek8xwLxpX23pFECNBJhjmm2/+7TaijxaTvPrsKm:So0aDJr/bupFECZQ//Xo43lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706867554, "uuid": "d5ca5285-3cb4-421a-9873-7783aba02056", "value": 6247512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706867554, "uuid": "bf4eb5dc-df4e-46e5-9473-b1ad329b9884", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706867554, "uuid": "9bd7ae1e-29d6-4022-b339-d1756f74c8f8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f33a6e9c-c189-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1706850873, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706850873, "uuid": "384eab10-3bbc-4b78-b41f-04e18b04ebb5", "comment": "Malware payload (Mirai)", "value": "14785bc0d97ba9cc9a84f3aadd60ae70", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706850873, "uuid": "17129447-56d1-4612-9834-822f1d83078d", "comment": "Malware payload (Mirai)", "value": "4ea0ad315942aecbba20add570c63ebcd3856586b8a173efc35b8cf3561c705b", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706850873, "uuid": "3c17e5a3-534c-4bfd-9b4a-3d50689ef8a3", "comment": "Malware payload (Mirai)", "value": "242fb740c99cea67fade41a77641f263705f19aa", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706850873, "uuid": "4b6a4f8f-d896-41d2-ab83-34e8661a4300", "comment": "Malware payload (Mirai)", "value": "5969682339498120cc0649518c40734d1200631f0e365749fd17f8897e7575164ee9c00ac39a85f188e1a0e23f861576", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706850873, "uuid": "a907a89b-e20d-44a4-a8a1-4a162b73ae97", "value": "T10DF30A46F8819B11C5D111BAFE1E128E37131BBCE2DE72029D246F747B8A97B0E3B915", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706850873, "uuid": "d5ec3b1b-260b-4f58-a569-9b0678d033f1", "value": "3072:OcP3l/dC4UT9tF7h1EXKh8HYrjaflmIrW5CkRR1jRJw:bP5BQ9rEXC8H+a0FBRR1jRy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706850873, "uuid": "1070a836-3d14-47cc-9fb1-0525b978609d", "value": 158716, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706850873, "uuid": "ac824e4e-371d-4add-978e-331064ecf839", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706850873, "uuid": "5b73abb3-6f91-43be-b348-3e5e2b8cdc69", "value": "huhu.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc67c3fd-c189-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1706850888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706850888, "uuid": "72c1d191-8396-4e59-b5df-f73ab6d071fb", "comment": "Malware payload (Mirai)", "value": "593c49ef8a0b72a73eff5e8158e1a297", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706850888, "uuid": "5325db06-9d47-42d2-9bba-cac8605be5c4", "comment": "Malware payload (Mirai)", "value": "5004f278c6b0e9e0de26aa1bb0e9f5b16ea0aedbdb2b8fa6838b2aa0dc9bbe1e", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706850888, "uuid": "9d6580c3-1ca9-4c0b-a0b7-90341a177898", "comment": "Malware payload (Mirai)", "value": "47a8798c9ba71c82abacc2b2e689808d6f1f8b9c", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706850888, "uuid": "6611f990-fde7-4e75-b034-4edc387475fe", "comment": "Malware payload (Mirai)", "value": "651bdbe93637cefd62381f37f365b76b86e752edbb5275d75f926e8dcbb73152798955484fc3ebf94a18acb9ec9ca0b6", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706850888, "uuid": "487a2ae1-8993-450b-8a78-75cf1c10025e", "value": "T167E31845F8408B27C6D212BBFB5E428D372A17E8D3EE72039D256F60378A95B0E37546", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706850888, "uuid": "f48c886c-5eb0-4b7d-bb2c-05ad6f3f8571", "value": "3072:zYtFGQNIHbgMzFsZa4d8mwKbqs+T8DhJt:zYaQQ/q04d7wKbST8DhP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706850888, "uuid": "3575c4f4-094e-413f-b9a4-b90537831bd8", "value": 150432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706850888, "uuid": "c14faf91-1b4e-4bf5-b540-e5489af60878", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706850888, "uuid": "6f908b06-63e0-45f2-a9a9-910697a5ba78", "value": "huhu.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8370902f-c16a-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1706837371, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706837371, "uuid": "a0bacdd8-451b-4f85-a483-20c4a8abf3e0", "comment": "Malware payload (Mirai)", "value": "92669f966e8d22dc3f33ddd3592741c0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706837371, "uuid": "fdc8e275-1482-4f0b-8ecb-61598ce3138e", "comment": "Malware payload (Mirai)", "value": "500b5bcb3086107dca1f594ec509fbcd8d29927b68ef955cdd96fb2e74c7c618", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706837371, "uuid": "63e2a107-8ab1-4e0a-88c3-43bb67327d1f", "comment": "Malware payload (Mirai)", "value": "ebb29297c527bbc211718bbf0e261e3a0ea3bb1e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706837371, "uuid": "67b560e8-3dae-428d-bc13-2e3eb8d00569", "comment": "Malware payload (Mirai)", "value": "8fb7764fa9da475e2dc9fe4345c611704da992df92cdeb4479b759210f8a054a2a031a36ea2a2ed26fcb28d3f83129a7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706837371, "uuid": "e6dc2980-a839-4e3d-9ae0-86b55998db54", "value": "T151839316BF601FF7EC9ACC338AA91705289D611E31A93B75B830D428F25B25F15E39B0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706837371, "uuid": "c166a3f1-822f-4e1c-801e-4df7cd43e173", "value": "1536:bw4pjQLOQ2GTZHslkJGAopJpPok9Z5ztyEd42+B:bw4pjWQAFslok99", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706837371, "uuid": "bbb5959c-a072-4ec8-816a-077b95e6d5cb", "value": 84172, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706837371, "uuid": "35436179-6d2c-4340-a3ba-ccf6bb1ea01f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706837371, "uuid": "d3df40fb-1f7a-48f4-a1a1-e9d3ee8d4b26", "value": "92669f966e8d22dc3f33ddd3592741c0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b40f8bc3-c200-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706901877, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706901877, "uuid": "af3340d7-83d3-4e9f-ba1f-1f4ca0678c10", "comment": "Malware payload", "value": "4528eebf9768bcdff16c507ec9b71142", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706901877, "uuid": "d2a98ab0-086f-4cf3-8814-8f86c77457a0", "comment": "Malware payload", "value": "52024b13500fda1d24ffe5f06d9da1d48bad6adfb3edbefbccd9e2823860723d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706901877, "uuid": "fc590487-c132-4241-8131-626cef0efaab", "comment": "Malware payload", "value": "01d64c3d1841357baa928bc940c44254911117f3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706901877, "uuid": "803f0168-306e-4ea9-bd1c-6fd7b0096aba", "comment": "Malware payload", "value": "d9944e53d445b620e32b6efd30ca283498848b134a051038887afbc5061949b76c2f6060fbfa7da7eacd67299254243e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706901877, "uuid": "1678a1af-9288-4428-a52c-7a28cbac59eb", "value": "T1ED559D0733A2C0E8DF6780F6CA295223E7727415173897DB64E05A2DEF93EA15B3A711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706901877, "uuid": "b379e705-2077-4d98-bbc8-6fabdac0af8e", "value": "a649e6750bcf2911044dec744c57f40f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706901877, "uuid": "421e4fdf-5d2b-4f75-a364-060de9c3f0a9", "value": "24576:wdofGAmSIQ177wZ+A7MjiiRDXU/Sat5RgsLSmIOHsU5zMmX1xYwncqKvGq260Uhe:wdofGbSIQ177wZvYjiiRDXASat5RgsLV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706901877, "uuid": "ef68ca3c-9927-44e7-8302-8761e1796a7c", "value": 1282560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706901877, "uuid": "394cfac3-9668-409b-855f-8e470717a685", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706901877, "uuid": "57af44b9-bfb7-4162-8d5b-b6d27b230cb7", "value": "SecuriteInfo.com.Trojan.Agent.31363.13966", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2972bf8b-c20a-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706905939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706905939, "uuid": "6bdb1623-97c5-41e5-936e-5cc7f3f7259b", "comment": "Malware payload", "value": "72d92a738c3de7fb9d152cb55634223e", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706905939, "uuid": "d4560810-ae93-4ad0-a17a-762c00f841ca", "comment": "Malware payload", "value": "52a534cd7f3ff24ec3d83974aa7fdae1af1f5282973ae541665fdd2296924fa7", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706905939, "uuid": "a0957aa4-c153-475c-b10e-27ff771589d0", "comment": "Malware payload", "value": "2edb7d4168331ecda8362129a4a66f79909b1569", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706905939, "uuid": "3bd4c670-efdd-401f-84cb-4bac420c60bf", "comment": "Malware payload", "value": "4764f8bfad98b8c01ca0fc7cbbe3f734bcf715ceb2ff58d45a4037a68c29a6d4494c641d233718efd1cc87c4ee007cec", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706905939, "uuid": "4b3a1da3-6b41-4b08-a1c7-0a7dee5a6a9b", "value": "T10B9338B9DA581B5A0D4F27A5EC816A41C5BE81654733007AFEFD034EE04B89CB7BE709", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706905939, "uuid": "bd3d5334-a6be-4b1f-883e-ff2219d0cb8b", "value": "1536:KQbty8Q6qpHYERpPMhzduoyzVtNdwXayHynHW7cyAIqy58a:Katy8Q6qpHDGOX4ZyeAIqxa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706905939, "uuid": "e7354e74-0a55-402c-ba82-b9904d71fdac", "value": 90327, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706905939, "uuid": "db189d71-ebf0-405d-8b23-d0c327b5e187", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706905939, "uuid": "fc18e417-ce1c-4a60-b480-793a0672e44b", "value": "Arrival Notice.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "179baef6-c209-11ee-b7ea-42010a9c0006", "comment": "Malware payload (LummaStealer)", "timestamp": 1706905480, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706905480, "uuid": "baff7044-bd92-40e6-be5c-f752ecd80859", "comment": "Malware payload (LummaStealer)", "value": "3cd409cfd9f2b22e24a0b458fee6172a", "object_relation": "md5", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706905480, "uuid": "8ae2776f-4dd4-4e21-88dc-49175017b759", "comment": "Malware payload (LummaStealer)", "value": "53dfd1056695f3de411b822ebcbe3bb682974ae2a8c3446f556e03e9372c5bf6", "object_relation": "sha256", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706905480, "uuid": "f975b0b5-ec0d-43d9-b25a-3c343eebf930", "comment": "Malware payload (LummaStealer)", "value": "74b73bf4ecd9d14afb4a263cde66d4cc305f72c6", "object_relation": "sha1", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706905480, "uuid": "6a6cf195-391a-4756-bcdc-65e9e56de5de", "comment": "Malware payload (LummaStealer)", "value": "be86a362155ff36b94c16af1202c547bddf647b109f993f886e0e0261712dd8321abb212965a9905b82019331edc4c9c", "object_relation": "sha3-384", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706905480, "uuid": "07a6e044-eb11-4bfe-b176-3b4e7a47b0fc", "value": "T164463347A8916125DCACB130C343BFAC34F04E6AA554592C71A46BCF9DF2CD6A2B7B13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706905480, "uuid": "fc9bc518-ceaa-4131-ab76-076eeb3286df", "value": "365adca02beed196c4485f1cc07c6dac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706905480, "uuid": "9e1aee14-186c-4258-8ecf-ef7810d68828", "value": "98304:zSYuhtcfVLmYBAfUnVx+QwU317Gln0q0H4U8Gcpe66wFjmmH4iFd0gq5ElRtH2Zp:Wa9aUdVx+NgE0q0H4ac4mAWHzqdh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706905480, "uuid": "5b7c30f6-95be-4855-9c11-af3358ca36be", "value": 5836888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706905480, "uuid": "46ae8b1e-d7f6-42fd-bbc8-ae45602abcc7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706905480, "uuid": "fc806271-1b14-49e3-b456-4b6974b419ae", "value": "3cd409cfd9f2b22e24a0b458fee6172a.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e10d5da-c17e-11ee-b7ea-42010a9c0006", "comment": "Malware payload (DCRat)", "timestamp": 1706845817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706845817, "uuid": "a11b5664-a2e8-412b-96f0-76363a5e0f72", "comment": "Malware payload (DCRat)", "value": "b2b416d08c3391ce0842d998e0d5f273", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706845817, "uuid": "07f6ddb2-70a2-4e79-94c5-8c87ebfae583", "comment": "Malware payload (DCRat)", "value": "54471e79557fcf3f12279ab32be68aee2ca1cfd68e29134d0b34caf6975c3254", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706845817, "uuid": "aa88f217-5c9e-4c3a-8da8-785b9ae00415", "comment": "Malware payload (DCRat)", "value": "b384e63d2d57c5c744d1da4e5e92faad09228ab1", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706845817, "uuid": "3a600e5d-3c84-4246-8f3d-3826cd4de37c", "comment": "Malware payload (DCRat)", "value": "56a1724f3e581b313630714e1446180211a3705296d753a59868f7ee78ac898158997c6fe2fb41276f3c5cfd3511843e", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706845817, "uuid": "cfd8132b-26c7-4fe9-804e-8cadfeaed195", "value": "T1EF553363D166A133CF3D9AB56A7682894430CB92DDB34F612E33B546DDB3C425CAF1A0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706845817, "uuid": "0b5959da-37f7-45da-9ccc-15df1b9361f9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706845817, "uuid": "7f57c157-b2c1-45cf-a2a0-c5c32d7c52e0", "value": "24576:eziaTTDWECSiUgQCl+V1KPOiLs1yYeunFqjTZfyt2V1zdPY0UavdQ1+fXmc1:UiUvCSH1r2s1NRqHZKt2V1zdPYVaNv5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706845817, "uuid": "a5f28e99-a0b0-4de7-8426-a5c666bb2389", "value": 1342951, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706845817, "uuid": "70b92098-0ba5-49d4-8707-3a6f3df3db2f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706845817, "uuid": "359901c4-f13a-441d-9310-6ad9c78a68eb", "value": "b2b416d08c3391ce0842d998e0d5f273.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cd61d06-c1d0-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RiseProStealer)", "timestamp": 1706881034, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706881034, "uuid": "f38a56e2-2df2-49f3-9469-abc1241c1652", "comment": "Malware payload (RiseProStealer)", "value": "43f068eb74d7702ac5e92e872722dd8d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706881034, "uuid": "536d60e2-04d2-4ad1-b363-7f2adb8132f0", "comment": "Malware payload (RiseProStealer)", "value": "549042e80422e3c9b258f968ba2e0e89d344b0a0d3bcd6c54023ac8b8b75c51e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706881034, "uuid": "e2ed27f0-bad1-4b22-b81e-47142b464e17", "comment": "Malware payload (RiseProStealer)", "value": "3ce3c14ab8cd0bc66d0db334b058c1843c024680", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706881034, "uuid": "88b659b0-e916-4d4c-84dc-7f4cda8186ff", "comment": "Malware payload (RiseProStealer)", "value": "cd94960be3436c4fc06febac28865fe25016e7c8afbb98b3aa9658e9a3c6c98c6428468921562259823f3f12471f4bbb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706881034, "uuid": "b8545608-3776-4436-a44a-28fa9e6211b9", "value": "T12FC5332537508172E223167246F5863A9F34B1B29FBAA0C3B9D83B573B513E273752C9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706881034, "uuid": "81334f6a-47e0-4980-bc84-22c7106d89ff", "value": "bf5a4aa99e5b160f8521cadd6bfe73b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706881034, "uuid": "941afd3b-e9ea-47ca-8f6f-32924c313685", "value": "49152:GkQTAtcW7mgO8m0C8NWTUCS/i4ovEOeLC8U2VR/l0dd8/7j9:GatcWCg93NIUCwi4p5U2j6K/F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706881034, "uuid": "f0a3f358-64d7-4217-8ef1-368ad717a0f3", "value": 2574592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706881034, "uuid": "c7064875-6da5-4db4-8722-754752c5d3c8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706881034, "uuid": "94177e2d-98b3-4aeb-a59a-e37dc6289c05", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd33f684-c16f-11ee-b7ea-42010a9c0006", "comment": "Malware payload (njrat)", "timestamp": 1706839642, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706839642, "uuid": "0206ac4f-c14a-4d1b-a3c6-e45e02371372", "comment": "Malware payload (njrat)", "value": "b5e053607b1502d723e1172c72f6f44e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706839642, "uuid": "22c08ddf-e4d3-4fad-a105-fa91cc216f4d", "comment": "Malware payload (njrat)", "value": "554f6e8f8c4ff143061ba997546cf69c7edb9b256fc209b29372e31e36edd051", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706839642, "uuid": "4ae7a365-c036-4acf-ad82-cdfcd1e5c9db", "comment": "Malware payload (njrat)", "value": "c23d547b453a8a0aed476a164dee6904ce429ef0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706839642, "uuid": "7c842a11-8561-4144-9006-17a551c27c5c", "comment": "Malware payload (njrat)", "value": "cde3ca719290c81b026e8875bf98bebe3eafe2e9082e57823a3757541708a352d9d80a989d548f4a065dcdb8282318d2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706839642, "uuid": "9c6fb5f0-d181-426e-a861-a5a9a321f7bb", "value": "T1B0F218593FA08176C2EF2BB406A2D72142B2D1075A23DB5F8CC844FA6B777C14D81AF6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706839642, "uuid": "81b3c357-0247-484e-8439-fe7b0920660f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706839642, "uuid": "b20023ec-c74b-425a-9950-eeb2e12a3e3d", "value": "384:oULdClEUdi/dMkt1QmY/GKSEZePC45SY2OzRLTm3yilqr64RbEyvGb:oCUEUdi/dMc1tEZeK45SsbRvGb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706839642, "uuid": "413a8cd9-afb9-42a8-9032-d8cbee70f189", "value": 36864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706839642, "uuid": "8e46c74a-c5fa-4108-a8a6-28fb1d917be6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706839642, "uuid": "01bdce60-7aa1-4bd2-a188-df02167b89cc", "value": "bTtU.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6c735d8-c1f7-11ee-b7ea-42010a9c0006", "comment": "Malware payload (njrat)", "timestamp": 1706898016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706898016, "uuid": "bc84e05a-29f8-478a-b840-a6a53eed3725", "comment": "Malware payload (njrat)", "value": "b9aa83e4bb5dcf404a118a3499c180b4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706898016, "uuid": "f8a85a69-8fe3-4b80-a6ff-d3f2929c9062", "comment": "Malware payload (njrat)", "value": "5647e8f07e026ae7c27dd2ca1273b0cb6738547668b35cdcb47e27c7049c2137", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706898016, "uuid": "e1e125c8-35a5-41d9-8286-b363c5ff41cf", "comment": "Malware payload (njrat)", "value": "b6eb15c01e788b443c922e25306f9253a7007f7c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706898016, "uuid": "bcb842d4-e848-410c-b23e-94d6c6fdc1ee", "comment": "Malware payload (njrat)", "value": "4be240dc51628bc116b6a1a8309091bdc8f7d6514b073b744df9718ff25c617b3ed533b91189d425289a2e33858d9ccb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706898016, "uuid": "c0a40bb0-61d4-481e-9629-0320454b8095", "value": "T109032B4D7FE18178C5FD067B05B2D41207BBE04B6D23D90E8EE564AA37636C18B54AF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706898016, "uuid": "33bf7dd5-b45a-49f6-8ee0-182d7ba48ac5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706898016, "uuid": "2fa6effb-2477-468c-880b-876f9716a6df", "value": "384:qGOQiluhHeTnMGiyMT3KPRxjnW+hrAF+rMRTyN/0L+EcoinblneHQM3epzXoNrnL:jpSMGxMT3KfzW6rM+rMRa8Nuift", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706898016, "uuid": "8279ac01-ebef-4fb0-820d-c5512799d186", "value": 37888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706898016, "uuid": "4f72d9c5-88e0-4de7-9f58-888f6d78c360", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706898016, "uuid": "3dc325f4-a2d3-4154-8684-9e593ed255f6", "value": "b9aa83e4bb5dcf404a118a3499c180b4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7afa738e-c182-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706847664, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706847664, "uuid": "efcf63a4-3548-4d0a-a441-884fdce26097", "comment": "Malware payload", "value": "7386b305da7fb9970e93389890035f26", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706847664, "uuid": "cafe2996-8855-4c65-8b61-e4f0ab9cf561", "comment": "Malware payload", "value": "5814136b744c545bfd3ea8666fcba3c7330eca2c755291ffc4a229149b4b7e05", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706847664, "uuid": "4560bb40-02e7-4ba6-9d36-9f4078d0c051", "comment": "Malware payload", "value": "4418307a938e77fba1368fa8b1c49af9d7aedfeb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706847664, "uuid": "0ba23d0c-3466-43a2-a217-2919561ae3d0", "comment": "Malware payload", "value": "d9f31bcbe3fed58f1a27a4b34f2a004a26c9a4c576fbbc5f38b2d03590213f0505b8da9611a6d8512a9a0fb919125abb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706847664, "uuid": "37f60dff-16a8-4052-b1de-e2d295891760", "value": "T155368C21769AC53BD57E05B0297CDBAE50A97FA00F7484DB63D84E6F49B08C34632E27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706847664, "uuid": "c01b6656-8a58-4e32-b8fa-6e82e3db131b", "value": "5b1f432109566ebe5c9c9d2445d33cf6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706847664, "uuid": "76bbdfcd-0281-4c22-a4f9-456fe8578e5c", "value": "98304:aM05CN1zgKkrRPjTQrHhz2Y5AUZW35D3R4x8xqCGomypGO:aMrw0a3MgtvYO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706847664, "uuid": "fc09c5c0-9385-49ef-b998-43c26c37b50b", "value": 5113027, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706847664, "uuid": "18ee9982-6a0a-434b-87be-0b99707f0006", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706847664, "uuid": "6c269c01-83d0-4b67-b057-71e2d0ebd82c", "value": "SecuriteInfo.com.Trojan.Win32.Agent.17043.15795", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a5e850a-c1a0-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1706860360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706860360, "uuid": "c2998a33-1e08-4e83-9368-8ac91dfdcfab", "comment": "Malware payload (Mirai)", "value": "56219906b850cfd9813091e8f25a6af9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706860360, "uuid": "872e037d-1b59-4a44-acce-6cc24474d8b8", "comment": "Malware payload (Mirai)", "value": "583a591a0ec59f654472c55b56e7877574e868fef688e8559330f7912c0e8e7a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706860360, "uuid": "3338473b-b108-4c49-82b1-59a8335d42a9", "comment": "Malware payload (Mirai)", "value": "85234d3aac981cb5ad0e1522c71af600f74f18a9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706860360, "uuid": "3fded1e7-0538-4829-b2c2-7b15ef6078de", "comment": "Malware payload (Mirai)", "value": "1f115380f93d79ff2a7d5ff6ad164d574c7acfeb0a5ef93cda65e91c28a1788d690d0650a3888c22194552ccd61d7425", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706860360, "uuid": "c7373e45-ebff-45bc-85a7-96c36d1654d1", "value": "T1D3233A02722C0A47E1975AB0393F17E093FEF99021E4F688690FDB5A8675E371186F8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706860360, "uuid": "d17139f3-16bf-411c-9329-500b9c629a2c", "value": "768:VcvtWyRmR3vHb89+0lE1DhBwuoFvtla5qSbRcfaxb:ottcZj0lIDnJo3s5qSbUat", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706860360, "uuid": "a45d01cc-99ce-4510-bf15-a839a5bcdb82", "value": 48428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706860360, "uuid": "9ddde91e-bb7f-4bac-9fe1-ec9b121b3f20", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706860360, "uuid": "d6bda193-f8cb-4b07-8d33-54c243411a68", "value": "56219906b850cfd9813091e8f25a6af9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76786901-c216-11ee-b7ea-42010a9c0006", "comment": "Malware payload (DCRat)", "timestamp": 1706911222, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706911222, "uuid": "e6f9ac9d-26e9-4ed2-8c41-6295e87af2f7", "comment": "Malware payload (DCRat)", "value": "1aa5d9952457355a8539f58e9b90f226", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706911222, "uuid": "121eeadd-fc70-4ff7-890f-5a11a905f087", "comment": "Malware payload (DCRat)", "value": "587cea05294f53a94a86ca0c597fa7c4f5c5f170bbfd0dca19605d8abe1acc05", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706911222, "uuid": "fcef92c0-8cf1-4010-b420-a24407caab0a", "comment": "Malware payload (DCRat)", "value": "9b1d53facde7c215a2e52cd72ca7bcd1c0d69bc0", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706911222, "uuid": "995c5502-2faf-4ece-b6d4-782b64c429bd", "comment": "Malware payload (DCRat)", "value": "16fc94c6048bc7ae6c58bd9981e1cd95be1cd988c068841e6ab9709462e94b7e70ce4192e2b3838b8b5db0ac5e28af34", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706911222, "uuid": "41683754-221e-4a10-9c04-82f0a85a9503", "value": "T1EC556B027E84CA11F0192233C6EF49488BB09D516AB6E72B7DBA376D55133A73D0D9CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706911222, "uuid": "d73aab07-e00b-4216-a2e7-21c2fb603f24", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706911222, "uuid": "f3592576-d237-40e6-b523-08efde836fe0", "value": "24576:kI9bfPOehzIIqG7VXSv7FRjnc52FqQe56e7lj+zhwr2k+v6Gpgq4eWqiSd:l5tIIqGO7FhncEqjA0l+Dvtpgq6qi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706911222, "uuid": "1dba5adf-293d-4876-a78a-d70627d9cf03", "value": 1307136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706911222, "uuid": "24a84017-0b77-427a-8c5a-e22626785aaa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706911222, "uuid": "4df23cf8-1629-403d-a3ba-5432908b8ea0", "value": "1AA5D9952457355A8539F58E9B90F226.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0089c362-c1df-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706887402, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706887402, "uuid": "c89d1b04-8182-4964-b712-09348469bb84", "comment": "Malware payload", "value": "1bd91109a1b7244395572baeffc18bd1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706887402, "uuid": "3ec5aced-06b6-4b68-b28d-2b845a8b43d1", "comment": "Malware payload", "value": "595abbae71bf2944ab67d52ab11585749cb64dfa3c852d90dab95574579e3e37", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706887402, "uuid": "599e7d17-c295-4292-aca8-6a5ab64c0f52", "comment": "Malware payload", "value": "397ab6205f386e356fef314731d086d932d8979e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706887402, "uuid": "ca0940b8-0326-45ec-9941-ff9015271a76", "comment": "Malware payload", "value": "b73149484b7c3c171065b61ff51ee737254723768fcb650d595645cb2e752d58e4f5fb4e90bf4f018fa466cd261df5e8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706887402, "uuid": "275087c3-b46f-473b-b341-80ac7307f938", "value": "T14033E186856F4EA8F63A043D48D15326E0AE41B4FF1068E315253712AF781D5EF32BF9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706887402, "uuid": "22befa28-8cc2-4bf9-801e-7590701a51c1", "value": "1536:lr73CQWHq1WmHLHJSk4Y5tkrgudLYmISR:tbaEWmHLF4AkFLYmISR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706887402, "uuid": "e1fb01d1-1773-4b96-aab8-094e39616360", "value": 53538, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706887402, "uuid": "c2ef2187-7549-486c-91b0-abda5bf717ed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706887402, "uuid": "5301f410-1ef6-4d9a-ab4a-bf7b1a27ade8", "value": "SecuriteInfo.com.Trojan.TR.Patched.Ren.Gen.8498.5443", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4235fdde-c1a6-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RuRAT)", "timestamp": 1706863031, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706863031, "uuid": "eb9857ad-afcf-4a5e-906a-234f19ecb757", "comment": "Malware payload (RuRAT)", "value": "ca40c078d37587a3aaadbadf6944f55e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Remote Utilities", "colour": "#145F0C", "exportable": true, "hide_tag": false }, { "name": "RuRAT", "colour": "#03BE1A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706863031, "uuid": "4c608b02-8f29-4ed9-b250-dc04c243d7d1", "comment": "Malware payload (RuRAT)", "value": "5c8d64d3278816980498d063560f2ad04b4a823b577f7979f43c8e3bf33e5b3c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Remote Utilities", "colour": "#145F0C", "exportable": true, "hide_tag": false }, { "name": "RuRAT", "colour": "#03BE1A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706863031, "uuid": "99aa9690-b9ba-49bb-8490-959cf35db135", "comment": "Malware payload (RuRAT)", "value": "265c187f8a923b239b67b9b8251c158c4494bff0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Remote Utilities", "colour": "#145F0C", "exportable": true, "hide_tag": false }, { "name": "RuRAT", "colour": "#03BE1A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706863031, "uuid": "d29f489d-d710-45e8-9a22-ebadb8e6c729", "comment": "Malware payload (RuRAT)", "value": "3e95a5fa021f289be29c98ed4fd1df7e695897675c7c5779d72801489f00f735f283e7b69cc4f780fdd9ff0638a927c4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Remote Utilities", "colour": "#145F0C", "exportable": true, "hide_tag": false }, { "name": "RuRAT", "colour": "#03BE1A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706863031, "uuid": "f8592a97-a516-433d-b959-a056273d326f", "value": "T125273306D79D18FCC8A9E67D985B4C47E633784D2211A48F176949A22F83334ED3F72A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706863031, "uuid": "340f3724-5449-4421-891c-bfec153ef9e1", "value": "b1c5b1beabd90d9fdabd1df0779ea832", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706863031, "uuid": "ff15557b-fdcc-46c8-90e7-1a7ddf35d9ae", "value": "393216:9zz6+gdQzi/Ew1x1vXYQBEPDdasNaAzEFuEaP3CxMk50pRZfQCy0lifWA5J8EOH:5HSvI+EPDdXNaHaP4Mk50hfh/ieA5nOH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706863031, "uuid": "0b7eb9d4-51cd-4a6f-8edf-33ddcd7bd168", "value": 20949417, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706863031, "uuid": "63f534f7-ed09-4677-bc40-fdc46fc29232", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706863031, "uuid": "dec25ba2-55a8-49cc-9492-5e1c794029e2", "value": "3_\u0420\u0430\u0445\u0443\u043d\u043e\u043a-\u0444\u0430\u043a\u0442\u0443\u0440\u0430 Medoc.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02def66b-c1df-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706887406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706887406, "uuid": "969b6a7d-f1fe-40f3-904e-ac424b6e85b7", "comment": "Malware payload", "value": "f9f81c321571b00eed4188c4921481e6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706887406, "uuid": "d3f4976f-2f83-4e4c-9cb1-40dc8d8aa022", "comment": "Malware payload", "value": "5e1c9fe472c7bb9ecd076d9b012e946eec3ddb21d7422f00995c9a5359e247c1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706887406, "uuid": "dfd5eb2f-c311-474f-bd9f-bd00fedc2748", "comment": "Malware payload", "value": "4fbdf8936718b451f7103dfcde7925fbc86d1b89", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706887406, "uuid": "0c6c5208-2e6a-4676-8a0d-aaf9e7a5a383", "comment": "Malware payload", "value": "3c3b8234371061bce8a98b774c68bf879f72a7095d0a6796e25f0c8e701fcb69a7dddc5f7d175030ccea7e45a6005ea6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706887406, "uuid": "1d3638bf-ad00-4ce7-9f05-25a53c89a235", "value": "T156F41206B624C449DCC8FAF15652857871307E0B2F44077AB56A337EABFB7039A4E5B8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706887406, "uuid": "a6679f64-d01f-43b2-9247-1e4a6d4a41ec", "value": "04da0e4abd5b36228ef0d93382e8ddfa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706887406, "uuid": "94e1866e-f1d7-48af-b23d-bc6e09304d57", "value": "12288:DHDWvRXmvVy+nZNoteV9urwR9twedd4xC33wvEw87eH4f32oSZK:HWvRAcMN394tUBwMwYyK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706887406, "uuid": "6504ad2c-c510-42c9-bc83-faef2fbe7bc5", "value": 735608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706887406, "uuid": "9336736d-f8c8-40d2-b46a-25c9bdb0c146", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706887406, "uuid": "4f0f4ef1-aa13-41ca-bb3a-2d425f388df0", "value": "SecuriteInfo.com.Win32.Application.OpenCandy.R.10550.6292", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6697f2c8-c1ac-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Amadey)", "timestamp": 1706865669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706865669, "uuid": "9889ff63-51a6-45af-a273-f451447bd18d", "comment": "Malware payload (Amadey)", "value": "154c3f1334dd435f562672f2664fea6b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706865669, "uuid": "6a420427-aede-44cc-b3cb-d76dceb34ed8", "comment": "Malware payload (Amadey)", "value": "5f431129f97f3d56929f1e5584819e091bd6c854d7e18503074737fc6d79e33f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706865669, "uuid": "ecb16764-0480-4cbc-9a04-458e1debb02c", "comment": "Malware payload (Amadey)", "value": "51dd25e2ba98b8546de163b8f26e2972a90c2c79", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706865669, "uuid": "1232b7ca-3e17-4569-9b7e-eed25590cfcc", "comment": "Malware payload (Amadey)", "value": "12adb9c84372b0afc33d89f8fb581069c8a8f25197da1701e748cb711dcc2a4b69a67ff6301f0f2bf267a59472e70270", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706865669, "uuid": "c4c6d7a8-59aa-4723-908f-720b040cb066", "value": "T1C4B35C217591C472D6AD0A791874ABB1CB3EB910DF745DEB37940A7AAE302C29F30D36", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706865669, "uuid": "175b5ca8-61cb-4486-bc6d-e369cb17e8c1", "value": "61d6334c6ae4948c906d9fa7fdf019fa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706865669, "uuid": "39bb9f99-61ef-4c79-9d04-01cb29a6888d", "value": "3072:D4uSD+ZwruS0bGYuZRtasSVh/QEIegRQod4l:kuTiabruZR8JSlD4l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706865669, "uuid": "a7407a4f-2778-4558-81d0-1035d560fde1", "value": 112128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706865669, "uuid": "3f2fe431-8094-4e77-bcd4-8d83c26bed4a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706865669, "uuid": "5aff76a5-b207-432e-990f-cb8658765db1", "value": "154c3f1334dd435f562672f2664fea6b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce6526e2-c1b2-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RiseProStealer)", "timestamp": 1706868420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706868420, "uuid": "2551cb48-4476-4760-82a9-7277cc626963", "comment": "Malware payload (RiseProStealer)", "value": "89302f7d2a8f2170fa154d964f518fa7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706868420, "uuid": "d461b81e-15f2-488e-b077-5e65fff021ef", "comment": "Malware payload (RiseProStealer)", "value": "5f76275cc7f8ed4c80ed17a063bc039bfb026b9ecaab3bcd481803499e25338c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706868420, "uuid": "79db8267-b6d9-4ae5-8bb8-674fa522017e", "comment": "Malware payload (RiseProStealer)", "value": "846337a284070b54ec2d895dc4bf1a773f1a8ec0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706868420, "uuid": "d0755f3a-c185-4a27-b7ec-3d0f4776ccdd", "comment": "Malware payload (RiseProStealer)", "value": "7dacfcb90701cc51db6b02a1f8f4844f3c61077b8b84e8fa405295fbec78b913c2c790aeaaf5a6e60c8ad227009f8868", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706868420, "uuid": "71b6b96e-905b-41ef-b2cb-24236ff62e10", "value": "T1AE558D71A652C075D19213F1316E6FE046DC6A3257A188CBB3C06E39AA711F3717AF2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706868420, "uuid": "f8c054c9-6ae8-4a6a-a608-02b36c24735f", "value": "30e61d50d6efffd7759aa76925b3b42f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706868420, "uuid": "c279c680-9371-4925-b3fa-2b0dcf236f57", "value": "24576:PAq2Zs/9cGyaKbnWqGgYkZpHDiL9O2GD6qL/TmAAuKIELwp:72Zs/978Hq9O2E6qL/TY0ELwp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706868420, "uuid": "07a48518-d5de-4da8-b936-fac1fee24749", "value": 1308160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706868420, "uuid": "9b016d9a-a64b-483f-91d7-464815a866b0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706868420, "uuid": "1d5b533c-d389-4412-9281-f30db8e4e6ca", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6190026d-c1dc-11ee-b7ea-42010a9c0006", "comment": "Malware payload (IRATA)", "timestamp": 1706886276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706886276, "uuid": "b24f4c93-ccb3-4c0d-9059-b483f524f0fd", "comment": "Malware payload (IRATA)", "value": "343c47f11a32840be13a91094f6ca04e", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706886276, "uuid": "531c7c93-307d-4c21-93c7-86083bbfd720", "comment": "Malware payload (IRATA)", "value": "61efd8fb1b925fb62b6faf21a884fd07196a846ef1dc682cd006d88ab60ce378", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706886276, "uuid": "6a0a4dac-69bd-488f-8bae-a97c4e2f6382", "comment": "Malware payload (IRATA)", "value": "e4f91aba51addffd80ae92a7c7563f6ecd1878b2", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706886276, "uuid": "b2496c3c-438d-4fe8-8033-297b24850c49", "comment": "Malware payload (IRATA)", "value": "c7da72d3fe18f75f6855287532e4465865069fb6b25803b6aec13cf500be68b27886d42101d9dc654e1376dc02eed8b3", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706886276, "uuid": "deedcce7-f187-44fc-83e5-fb123de96939", "value": "T1BB851247F776A957C832C1322445173922160E28C942FB4A3C887BFA69BBDEC0FC56E5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706886276, "uuid": "71741e69-9efb-4b01-83cd-04f363fde73b", "value": "49152:dsjkkzEXsRvvhcu3NZjEp2QhzN70eq7oXGE/G:KkkoXYnhc0NVWPN7BmoWEe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706886276, "uuid": "ac6895d9-5635-4e1e-a6eb-dede34e79c4b", "value": 1744373, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706886276, "uuid": "99c10652-36e9-4933-b65e-4aeed6adb344", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706886276, "uuid": "b25f28d5-f904-4b6d-bbf9-aa5537a1b2c3", "value": "adl.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c3291f2-c1bf-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1706873839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706873839, "uuid": "b4071939-0c5b-4b90-abbf-59a9ece22e27", "comment": "Malware payload (Formbook)", "value": "7387eeed685b4acdf46a1af416517e28", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706873839, "uuid": "5d1712e1-f5c9-46f9-a462-3ce3467262c4", "comment": "Malware payload (Formbook)", "value": "623bf04fa5da693e9243bc5aa9d093bbbf78dc59852aaa8d8c8c0988dfe153a6", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706873839, "uuid": "b595fa6c-351a-456e-af24-a6a71231762f", "comment": "Malware payload (Formbook)", "value": "5b17a85b39b400e241f56cbbc6bbcb29c796b12f", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706873839, "uuid": "25ee065c-8bbf-4329-8a48-d4648613eb4d", "comment": "Malware payload (Formbook)", "value": "382f204086284563727c9d116e7e48e567b850b906c4d75b53826b96f195d3a48e36cef11f4e7e0a52d3ac30d1f0c4c2", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706873839, "uuid": "1c83d229-0e2a-459e-a89d-22ad97dd6085", "value": "T1C9F4235F22DF92718DB1C16F86EE09A8D58D76B0A308157AB2F66E84DE4F7143CD11C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706873839, "uuid": "5014f7e8-bbec-4787-bde4-6aebd3052934", "value": "12288:CR6X/SDhfmnOoaEns7heoixsP1AVBtS/ZhpkqfkozXze2eFVqzGb/1F:CMXKGRnSeoixsK1mxkqkozC204Gb9F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706873839, "uuid": "9a6ebe53-733a-4006-8555-016669685525", "value": 744922, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706873839, "uuid": "9bc3bac8-fcf7-4724-849a-e84aacc33a46", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706873839, "uuid": "10f6d93a-ae2c-4e8a-b2a6-d8b2f69aed9a", "value": "INVOICE_1.XZ", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f75dbe1-c18b-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706851403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706851403, "uuid": "aa1d35ae-a839-48c6-9def-1df50c1d19c1", "comment": "Malware payload", "value": "3ef712fff55786d9c88e438c0e9b64fc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706851403, "uuid": "dede73fc-8e79-4c61-9f3e-b8c3c78350e6", "comment": "Malware payload", "value": "633edf72348a8f439dd839054c4795578c8c055b942004fef61821047de604c1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706851403, "uuid": "98d8dcf6-46e1-4a90-9cf8-ce85003a5169", "comment": "Malware payload", "value": "999447b41a54b3ce86d1d04e18728d28747ff495", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706851403, "uuid": "bbadd37f-9206-4c4d-bc6f-d63e799a86f8", "comment": "Malware payload", "value": "5a0cd0a7ae9efea0ede3249b4e11a0b9e980e45a6f79e6f9c182c0168223c1bebf67cd4a870841902db582dbfb7bfea7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706851403, "uuid": "d5db53c2-977b-4b01-a5b0-4c201152bba0", "value": "T1895612BE2144331CC01AC9B85537EE0AF3BA562E17E5D8AE77CB76C07BA74119502F4A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706851403, "uuid": "a20dd904-2e2d-4185-9de7-20079f75f35b", "value": "d3ab2cf31941bda21b27cacfffc18c55", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706851403, "uuid": "c9903933-2b50-47c2-b49c-adf615512168", "value": "98304:gr3SCHQHBwoGFNRnmBkvDOaOizE7deEjNX7z/Ic6qg5CIuFnoQQhk:gr3SCKzmpwMyFiY7dJ379+AFn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706851403, "uuid": "6b93d1bd-56d2-4e72-9b0e-006f0b8e1814", "value": 5945344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706851403, "uuid": "aebf045a-6bed-4ce6-baaf-4d1588853283", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706851403, "uuid": "e7ad08c0-36d5-4762-82d1-516635eb3ab0", "value": "SecuriteInfo.com.W64.ABRisk.SEHN-4312.15067.11103", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4070ef02-c1ed-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RiseProStealer)", "timestamp": 1706893522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706893522, "uuid": "2d309d6d-1d17-4d10-901d-980b029a1d6c", "comment": "Malware payload (RiseProStealer)", "value": "cb378d121a58ae73110a584dcc30a4c7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706893522, "uuid": "449ad6eb-ed46-4116-85d2-a591965a5cf9", "comment": "Malware payload (RiseProStealer)", "value": "653073497245824044b8a565f862764535a57b498001283c536236da4395e226", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706893522, "uuid": "508c3d49-b5d3-4c04-9735-24e680c27aaa", "comment": "Malware payload (RiseProStealer)", "value": "c859cccee166f1439be3ae57e4b103c535d9e352", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706893522, "uuid": "5ad6ae3b-5d1c-4d11-a150-c0d302723b32", "comment": "Malware payload (RiseProStealer)", "value": "a7c0801c3f4b6d9cab6c856b874a87f3ecccfb1ff15e0b9f1bb05995d06dacc2f681a67db4b7230ed99488c437588001", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706893522, "uuid": "c3fe023c-4748-40dd-9d87-ecc543048fd8", "value": "T1FEB533D56CF14353F467937C76A62016930F6E0F99D18AAA105EF9F6ABFC3300296E41", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706893522, "uuid": "de3bf6c4-79e3-4106-9b42-93bf327ebb55", "value": "baa93d47220682c04d92f7797d9224ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706893522, "uuid": "19729c6f-7e4d-47b5-8482-953b5eb62d7a", "value": "49152:nMNUcI456Z17BfdSwZlFAiuaZ0K7ePQ/wTlOUh9ms5iKdmIkbdPPx2vrx6OZJ:MNU74Q17BfdSwZlaaZ0KKQ/wTh9GqrkO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706893522, "uuid": "1a447bb4-3ad4-4e5b-9cd7-4a46ce4ae643", "value": 2315264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706893522, "uuid": "7d1f610c-4221-4c65-8967-77ae55921fbd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706893522, "uuid": "ffcf5c79-b022-4b22-b1c4-60d912aff1b6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c309cee-c1bc-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706872631, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706872631, "uuid": "400915af-5536-4a24-b27a-d4d66bb46efd", "comment": "Malware payload", "value": "b8f6f0211aa8459494a8399ccae12d01", "object_relation": "md5", "Tag": [ { "name": "discord", "colour": "#27793F", "exportable": true, "hide_tag": false }, { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "EpsilonStealer", "colour": "#559F06", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PlanetsTherapy", "colour": "#A55C4E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706872631, "uuid": "fb6dc251-7209-423d-898f-923083b3addc", "comment": "Malware payload", "value": "6788cf4dc76d885626635794bf279b4aeb17a02a08640f199b4bd45c9d81fee7", "object_relation": "sha256", "Tag": [ { "name": "discord", "colour": "#27793F", "exportable": true, "hide_tag": false }, { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "EpsilonStealer", "colour": "#559F06", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PlanetsTherapy", "colour": "#A55C4E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706872631, "uuid": "1559d7eb-5dec-4b70-8adc-cf62d05896ae", "comment": "Malware payload", "value": "925d02f5cd8cf07a73dd21450e846264f9126ff5", "object_relation": "sha1", "Tag": [ { "name": "discord", "colour": "#27793F", "exportable": true, "hide_tag": false }, { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "EpsilonStealer", "colour": "#559F06", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PlanetsTherapy", "colour": "#A55C4E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706872631, "uuid": "be5a210d-1bdd-4887-8fdd-8f4c016c8492", "comment": "Malware payload", "value": "e61c868534d86a1d8ead0d4e948798b9807911d4323e7449378a30e443d1253e3ce44796f6850f0134d5cfbbae224b4e", "object_relation": "sha3-384", "Tag": [ { "name": "discord", "colour": "#27793F", "exportable": true, "hide_tag": false }, { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "EpsilonStealer", "colour": "#559F06", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PlanetsTherapy", "colour": "#A55C4E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706872631, "uuid": "b388bbc0-90d4-4c85-8eb5-817bf2405d4a", "value": "T1B6F733525AC2BC8ADC57D9FD413191AC94E8A59A9BF34BB341341D58A832E4F0BFC31E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706872631, "uuid": "210c5caf-52ea-435f-af1f-7dc36fa371d3", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706872631, "uuid": "63c8f8cc-98fc-4719-84e8-b9c4e8b4ccb8", "value": "1572864:/85j9WU7q7sbwyRNcy99REqU/rTsGj24HeT7rWO8P9z4PeBjO6C7:OpWV7qwiNFnEq0cKlQCjP9z4PeJw7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706872631, "uuid": "5eab1158-1f8d-47b0-b7a2-a49d633f361d", "value": 70203266, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706872631, "uuid": "08e416d1-c185-4026-834a-a782622d4350", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706872631, "uuid": "f2a40731-37d3-4a8a-b365-28ffab9f51fe", "value": "PlanetsBeta.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "321bf2aa-c18b-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1706851408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706851408, "uuid": "64efe78a-30c8-4f31-9d73-f7ea5756c9a4", "comment": "Malware payload (AgentTesla)", "value": "d5d6637057e5f93cbffc2bf2dc510e87", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706851408, "uuid": "4a305da7-3ed0-47fa-851f-3e1eb9cf3430", "comment": "Malware payload (AgentTesla)", "value": "68c3df68c0a9fecf5aca978269493fbddfe2137d03f4d7edc6b362446b96de33", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706851408, "uuid": "2af3f108-6b5c-4d07-9366-dd680d79a5ea", "comment": "Malware payload (AgentTesla)", "value": "08aa92e25fb4a25ad8cab3740edb0105fda211b4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706851408, "uuid": "54ae1ae0-82a8-47b4-9d5a-8ba835de167f", "comment": "Malware payload (AgentTesla)", "value": "a17b8a0415a5b44bfa620e867ca1a2be0ece7edff2adf1150fdf34d387deb955fac440fe38ad32ad51efcccf08deb8e5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706851408, "uuid": "34bd228d-9dd6-49ae-a15f-1ba75f9dfc9f", "value": "T18AE4125263BD0F31C27A4BF97850518007F6B6ABB672F64D5F8970EA045AF084BA0E77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706851408, "uuid": "bc100bbb-af9a-4cb8-9648-897b12dc301e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706851408, "uuid": "454f21e5-b044-45f0-a2a9-f31b38958222", "value": "12288:pMO915LLGkYnIx54p9YK965YSeJsTNzp+6Dg6gUyv5Gsxt2rRhd53rD22h:uOVLLXYnIL4p6tMsTNzphDUUsxM/rD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706851408, "uuid": "3b32dcbc-5beb-423c-9b7d-ede5c78ae58d", "value": 708608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706851408, "uuid": "41daf8cc-77e2-46d0-aaee-4ec73386beaa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706851408, "uuid": "5aa60429-21b0-4f93-993c-4903dd478a5f", "value": "SecuriteInfo.com.Win32.CrypterX-gen.24503.11316", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09d545db-c165-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Amadey)", "timestamp": 1706835019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706835019, "uuid": "2c2cec48-15af-41c2-9740-0344b256ed8c", "comment": "Malware payload (Amadey)", "value": "4d8b92c5ba2a991d5b71d9b47ee42789", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706835019, "uuid": "7b086a17-a271-4cb1-997f-90f37eb4461c", "comment": "Malware payload (Amadey)", "value": "68e4ec5353ebf39650fef8827957802e36a0f2617838bf57d3eebc9bb9a8df61", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706835019, "uuid": "d2348e5a-cd9a-4b32-a3f3-5fe7edf0bd9f", "comment": "Malware payload (Amadey)", "value": "24b887e898fb495bc0b8fb3ec6cae0715316dcd4", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706835019, "uuid": "784285fd-3b65-4d25-9cad-94939f409f56", "comment": "Malware payload (Amadey)", "value": "5cdda7e696e8c991856d8b87534ff257befba4cdde484d22175a841787eb7d8be6878e24195484a95b750bf90f107e1a", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706835019, "uuid": "7f8db4ba-c332-4d73-91dd-b430494f62a2", "value": "T1950533F741729522E17A72B0388609F86A70B85E76C8EF39731F05A529642AF9713F43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706835019, "uuid": "cbf11858-cbd3-408b-936a-642c8b061f07", "value": "7515ecf8c0dfa4d230ad835fe0acb57f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706835019, "uuid": "2780ba60-f049-4e4a-a787-35c68f422588", "value": "12288:gFP2SlusFFenRo7YNQu4WioPJicryGBWECTFXB5XHrvBOXNpbyk8MtU1h/KH:A2UL2nqwQf6icoECJPXLvM8MYh6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706835019, "uuid": "182db050-f483-4ac7-bca9-b5b856490011", "value": 811008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706835019, "uuid": "32ece084-ed37-419b-8712-6adbe2f55149", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706835019, "uuid": "bb1c9179-35dc-49aa-bfb0-4b8ce177aded", "value": "4d8b92c5ba2a991d5b71d9b47ee42789.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "292d3766-c20e-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706907657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706907657, "uuid": "80d27d8c-8511-4648-aa75-cd815c188242", "comment": "Malware payload", "value": "65781ba4fd05e1700b137ab91119e89c", "object_relation": "md5", "Tag": [ { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706907657, "uuid": "beaa24b4-51b2-4b7e-b3d1-a59507973d8e", "comment": "Malware payload", "value": "69377a13644e0e1dd5abbfaadcac2712b63cc3e797fb7b355eddfb3184dac619", "object_relation": "sha256", "Tag": [ { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706907657, "uuid": "71e13b59-e55a-4bed-ab2e-f0c46b5a8735", "comment": "Malware payload", "value": "daf3b007842c673c02e1563a41df9cc695353722", "object_relation": "sha1", "Tag": [ { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706907657, "uuid": "08244ee2-3f07-4d1d-a151-0807dd8d10b1", "comment": "Malware payload", "value": "1e630b5e6a7d99768dea45171b5c58a9a8d83754377991db284adb1aec6c839673a7879b94a1a89a07b072056f984077", "object_relation": "sha3-384", "Tag": [ { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706907657, "uuid": "de7b4982-af4c-43fa-a9b2-9e2e6048214f", "value": "T1AE0533240A881DCC2E744615A640FBBFFD54E044AA5CB3A6D6E6947EFC1D1F4CA2F8D8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706907657, "uuid": "fb1a2b45-8aa2-4ada-a649-4433c6014e39", "value": "12288:3hjJs9uHpnB7DNbnDJ4wFY8YXsCdLsXOjJu/Y1pRMHSgIczkYdPgcQOkSkBqUr9e:xls9eB1jCwFY8cseNu/QpKH6K/UopB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706907657, "uuid": "d857641d-f83f-4498-a7fa-1f7a38970f3b", "value": 822907, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706907657, "uuid": "d806549d-045c-46cf-a323-59fd88c65881", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706907657, "uuid": "38280686-94a2-42e6-8f79-1316df8f917c", "value": "dm.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3023d493-c18b-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1706851404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706851404, "uuid": "f984815c-76f9-413c-95e1-999005f46000", "comment": "Malware payload (AgentTesla)", "value": "845cfe32e2f6adaa400fa5da68ffe5ad", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706851404, "uuid": "cbf5c06c-a159-474c-8335-b07c8e3853c2", "comment": "Malware payload (AgentTesla)", "value": "693ae371f17cddec2a46582f46889577abf0e84185fd2f95191566061ca532c1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706851404, "uuid": "79669d37-03e0-4a0d-a7f0-9bcb92c3ef5b", "comment": "Malware payload (AgentTesla)", "value": "78b5762c676c17911fa52f0354210a43ebee3b6a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706851404, "uuid": "999274a5-89c6-46b3-bdb7-6242ab6204c7", "comment": "Malware payload (AgentTesla)", "value": "777f0db68e60d960feac1dfc49b88bf4c31479f2b43c21f999538420ec37e4f157eec92088850a8cd9f4d27f292e9a5f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706851404, "uuid": "1407bfa3-6b23-4ec6-807e-9e597495ac96", "value": "T102E4122213FD5B32C17953F8646180024BF9BDB6B721F65D2ECEA1E61A5BF014A10BB7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706851404, "uuid": "13f3c18d-62be-4be4-9512-801ac660c033", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706851404, "uuid": "1a9bcd9d-9c45-46ba-95c5-47b9920379a3", "value": "12288:9th6bmX4GXU2lUQQLwOSpbHTEimFD8Nla9cI9SJfbax2CxYad53rD22:fob/Y8UOSpbzLmh8TaCI9SJjxwrD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706851404, "uuid": "4decd9f7-0fc0-45de-a2ad-d1c50ee14a3f", "value": 712192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706851404, "uuid": "dfd828ac-6d08-4597-acd6-d783a5c737fe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706851404, "uuid": "c2d40f44-4af7-42ba-8de0-ea3af8beba28", "value": "SecuriteInfo.com.Win32.CrypterX-gen.18920.7401", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8c1fd1f-c1b3-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706868867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706868867, "uuid": "93fac34b-0768-4cad-9e94-30c7f34fe237", "comment": "Malware payload", "value": "982de2600aa4962cf177e6e3d6ada72d", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706868867, "uuid": "fa0db2ad-2c99-4b84-9cfb-4dc29d22bc20", "comment": "Malware payload", "value": "6a700eb9cab086f3beba177d6cf0764af82e6fcff07890930bf50e456a539399", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706868867, "uuid": "6c232990-3e14-4132-ab29-396016df9839", "comment": "Malware payload", "value": "d3666fe4576a7a5aefe4e52e149e332490d81923", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706868867, "uuid": "a8438359-e42b-4171-958b-442b0479963e", "comment": "Malware payload", "value": "9677328b71ebed4b38043196dbe2237bfbafa8eb47b557141d0a9dda217b7a4a1d0014943e497adab9d0899cbb1d0ccf", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706868867, "uuid": "7413ddab-b8f2-4d29-9bea-04f4256e6e86", "value": "T1B3D328077981CABFC497D1F44BEAA536DC32B82D1935715A2794FEA21F49EE02E1D220", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706868867, "uuid": "e79481ae-a992-4794-a4d6-d9ed538a983a", "value": "3072:bZf1RE03gpkDWpTj1WzYze/LIUdyj5G1q:bZfn0d0YgHq4q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706868867, "uuid": "95c66732-74c3-474e-97c1-fd2e208d161f", "value": 141640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706868867, "uuid": "9036bab2-d922-4f27-828a-cd09baa08c62", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706868867, "uuid": "44cc92ce-a155-4e06-900d-421730d5e981", "value": "982de2600aa4962cf177e6e3d6ada72d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "daa62a89-c199-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706857703, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706857703, "uuid": "a46e5836-43ba-4e58-92a0-0bbce4ef5cff", "comment": "Malware payload", "value": "034db07510f3ad0636aaf73b5d93f0bf", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706857703, "uuid": "298189b7-5f27-4f85-bd4e-ba913bd71793", "comment": "Malware payload", "value": "6aab957c6455a97443da163bb9cecc395c2238b264700e4333e42d36b7e0f2f7", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706857703, "uuid": "1548b509-4ab9-4ca0-9160-db5bc16d176a", "comment": "Malware payload", "value": "5d94dfb296b08b3fedf6dba8c46685c1e8b6b970", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706857703, "uuid": "85f0b034-9f03-4371-895b-43272f33b675", "comment": "Malware payload", "value": "fc9856201749a6fb8948a76f2ea5a1a5304acae1537db9ed05f3a71953bd028187c959a53339196dcb609558ca565a3b", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706857703, "uuid": "051021db-bd50-4d36-9e3c-fc9aa9de049c", "value": "T16A746D38B139568EE5F37834C93538B9624191FE8D0DAF8870096978D40BDE32E9AD77", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706857703, "uuid": "c18d551d-3b4d-4e90-979c-7706303edb65", "value": "3072:NYWQY45kN4/V5QrESmp+n41cvx+AsSLLLFWSyxxfFSpiCrEceQDpiCrEFydrp6F7:N8p5kuSmwCBtSLLLFWSyxxVKe82", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706857703, "uuid": "cbb4b4b2-6c56-42e3-9cb2-205280b39554", "value": 340400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706857703, "uuid": "2dc04c3e-b61d-4693-ab31-3c8592e0e36c", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706857703, "uuid": "b652e2c4-1813-41df-88c2-ba62992d4454", "value": "123 Rombout Report.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aba0319e-c19b-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1706858483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706858483, "uuid": "54eb1df0-43f5-4e18-85e8-aff8f63f7f32", "comment": "Malware payload (AgentTesla)", "value": "76381c2a1ac66d55340815b5b5f83122", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706858483, "uuid": "7073081a-b99b-4140-9f58-53b5543e5ea8", "comment": "Malware payload (AgentTesla)", "value": "6aacb47cd9ee73e3ab1b44fbd84c604a57f0c97ba393974cf3b8c2cdc0d63966", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706858483, "uuid": "0e4144cc-9411-46f5-9e3d-22a627c891c4", "comment": "Malware payload (AgentTesla)", "value": "7dd48d25b2bb635968e791f660aeb27bbbf8d299", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706858483, "uuid": "32700f57-32cf-4a1c-880c-9d85f6ebac58", "comment": "Malware payload (AgentTesla)", "value": "e9a441877036c3fa694a226d45bcb61975d919478c02837898e464e9aeb6cf7bb41bf0f42e8d34674a48374d1be088bf", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706858483, "uuid": "e393e7d1-63bf-492f-82b4-dddac5b37979", "value": "T1D6E4236F7C32B8DE74366A8B701C6553F49D621F151BD9E2AC36019A6CAF8CC36087C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706858483, "uuid": "e8c91c1c-ffa8-4a95-b713-6ec31c154cef", "value": "12288:GV6/NC5FdhJnb0aMB63JAMwVdVBX53AW64Vawg5XWgTbLMeTRk1c4u:zNETJbxMB6o5b3A0LWXW8nMCKc4u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706858483, "uuid": "feee99f5-7ae2-4b7b-a391-b6e5bad8d13c", "value": 671470, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706858483, "uuid": "f86b9688-26bf-4521-973a-7fe4c65d2985", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706858483, "uuid": "b5388fa6-7661-4dc2-b85c-792b45955f8f", "value": "QUO-02819.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a80e128-c1bf-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706873836, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706873836, "uuid": "b11a665e-e20f-4928-9e34-20c330552ff2", "comment": "Malware payload", "value": "1a15d60aaba13addd9715d7fb55d2e62", "object_relation": "md5", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706873836, "uuid": "48b54e9e-1e73-4705-9bbd-a6402941d245", "comment": "Malware payload", "value": "6bb0c0a53045ac4ac749b6fc3b00a62007bf54bd1f845860e254067934c9f8cd", "object_relation": "sha256", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706873836, "uuid": "dcb15dbd-3493-43f8-bb45-1fb2f34b930f", "comment": "Malware payload", "value": "dcfced2f12c5bb620981a52025d8286824fb459d", "object_relation": "sha1", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706873836, "uuid": "4c6e52bc-4f8a-46a6-aca5-f44d3c6dae3f", "comment": "Malware payload", "value": "9c4e17fd91c573b5777d986dd9c9190123de1866b1ca462398433dfaaf49250ee38a7fff72e0f2b069558122f9be728e", "object_relation": "sha3-384", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706873836, "uuid": "4d7c7e65-efc6-41e4-b255-230257e280ad", "value": "T1D8E433D43CD5E6865FD1462D2666FB0C9B281A446D8B8831FD1DF431AAA8435C3B2FDC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706873836, "uuid": "b75e5a1d-772e-46f4-969b-08024586cdc4", "value": "12288:05ZvYahtFRrL0Q8P3A9fYt7WpR03laSHrzzOqoIQ:OZRzriIAxoal9HXrI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706873836, "uuid": "a79ad7cf-0eed-4b72-873f-9e644c7be1ee", "value": 662235, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706873836, "uuid": "24689499-97e4-4a37-8b93-5704720d78b9", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706873836, "uuid": "6e4836d3-fea8-4d97-b860-890067a6a90b", "value": "bewijs-van-betaling_30-01-2024T1122-pdf_1.r00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee007441-c1bd-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706873198, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706873198, "uuid": "cbcc3a3e-c364-4a6e-aded-0f3e019146da", "comment": "Malware payload", "value": "57ae514462dca2bff4019122972a6a58", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706873198, "uuid": "fd181bc8-7d85-4a73-8cbe-b1b2aa7edeeb", "comment": "Malware payload", "value": "6c913a06abfd44dd30b446a68b2accc4ad3f5a53f3a6e63ed55704f8378598af", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706873198, "uuid": "6376df96-e51e-4ca2-bd67-d32795ce6434", "comment": "Malware payload", "value": "b90993c04665f0242f6fc663d9600f1dc89e6a63", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706873198, "uuid": "5bec457a-8310-4169-a9f0-216ba4ce4861", "comment": "Malware payload", "value": "deddea94c6d378ffce65b4bb052250246580c6554ed709d184f3d5999c7382d41eecb28ce8b5739b1c10a850e1e6088e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706873198, "uuid": "1f020ffe-0694-4133-8112-ffe45f6db41f", "value": "T11AC19510E3E5833EEA378B75AE33474046B9FB219D26DB6C25C4290EBD266444D33B32", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706873198, "uuid": "c2fa9c6b-62d0-48fb-b3e1-4996bcc51b97", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706873198, "uuid": "42db6154-58c3-497f-9e8b-9d94a73e9c38", "value": "48:6UaOO8vYaJCEjlmHQMJNM+nw90TUeDoDhLV0q23tESLUmOtt4lfA5mFzpfbNtm:mGvbkEYHczNdV0C6Fd9UUzNt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706873198, "uuid": "fc85ccf9-d6ef-4a7b-8784-15a4d02cedce", "value": 5632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706873198, "uuid": "c7dcf82e-a003-49ac-9f5b-b6a7f2bb7d79", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706873198, "uuid": "c7c00102-2c68-407d-b3e2-d0dd791a63ec", "value": "SecuriteInfo.com.Trojan.DownloaderNET.74.18381.3316", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc8b1e5c-c198-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AsyncRAT)", "timestamp": 1706857223, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706857223, "uuid": "eaf8230c-bc44-408f-b091-ef388fec22cf", "comment": "Malware payload (AsyncRAT)", "value": "b423cbb605900fff304f59d4a42843e7", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706857223, "uuid": "193a9151-8f85-4e3e-bee4-522874b4a7ae", "comment": "Malware payload (AsyncRAT)", "value": "6cb8076e98be148c3ada15db2cb41466b0a09bd48b33f9d8de54a77a92c8c64b", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706857223, "uuid": "9d2d9441-e6af-403b-aba1-0cdd244aedfe", "comment": "Malware payload (AsyncRAT)", "value": "33fd4e8fe5e0c001409b9a7a9fb4336e634142ff", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706857223, "uuid": "188da9d3-4014-47c3-b44b-cbdbc76cf153", "comment": "Malware payload (AsyncRAT)", "value": "01f6d92cca5c9a57964e9125e0f6b2a894dd81f83f2b87cc3c2bf394d9cd265e5a87c8769556303d0855ee5a7888ca73", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706857223, "uuid": "5328887d-5bf2-41cd-a9d8-bba0ea7d3315", "value": "T1016309053BE9901AF3BE8F7469F262854AF9F56F2902D91D0CC510CA0672BC29941BFF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706857223, "uuid": "c17906df-d6f3-4e7f-ba19-3bd7f008e3ce", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706857223, "uuid": "63c22b5e-6164-4d4e-a336-5761a666fe22", "value": "1536:k2c636fiQk6gcKu/UYFHbfoh7fgKaMbVkCjxmSeDwrQTGBx:k2cm6fiQkOKu/UYFrodxFbVCVwGyx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706857223, "uuid": "7c1ffc88-7cbb-41a4-8afa-594a74679472", "value": 67584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706857223, "uuid": "6e5066f1-1172-4e55-b4ed-8dd0ada3fdd0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706857223, "uuid": "cac95ae2-97a3-4c99-96a3-fb53e9053bd2", "value": "b423cbb605900fff304f59d4a42843e7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad9a880f-c172-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706840877, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706840877, "uuid": "e0fec9e6-a127-4625-b285-af4668af6537", "comment": "Malware payload", "value": "196e5fe7d52b3341e808f07290a8cb60", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706840877, "uuid": "4c576b26-f479-487d-aff9-4fabe5d3ffd8", "comment": "Malware payload", "value": "6cfc4f1809b6fcc0e46893289302bce3ab3840bd673adfb72d3a765a0fcca9c4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706840877, "uuid": "165e9c66-4f84-4676-b6ef-b234cbc2998d", "comment": "Malware payload", "value": "9ee896475fd347655b66aa5502f2d0daeb91e616", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706840877, "uuid": "64d75526-e1ef-4232-b46e-4cf5611a0b24", "comment": "Malware payload", "value": "3ee6effe7ebec903078c096cdbbf09ec0ad8f8f47062924cd5d36c57f819a951d6bcd1c8ed2440c1400595584316914d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706840877, "uuid": "666d71bc-5567-403d-85e8-410f89e81e7b", "value": "T13B86223FF128A53ED4AA8A31467392505B7BBE61A81A8C1E57F0340DCF765702E3FA15", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706840877, "uuid": "7308aece-0113-4866-8186-1c6ff9e67969", "value": "5a594319a0d69dbc452e748bcf05892e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706840877, "uuid": "d06fd7ec-950a-4480-a199-3a57200e2604", "value": "196608:osFZ2S5q+JYl3Jdo/5zjNM+mkfq9RdXpbkODEqErjq:oZS5qu83Jdo/5++mkfqHdXDDEbS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706840877, "uuid": "9507cbed-daa5-4e9f-a948-ae513975215b", "value": 8168456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706840877, "uuid": "fbc98a94-07d8-4c50-a801-f341df5fde67", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706840877, "uuid": "a0a4cd25-3e1c-4baf-8e34-1f8b867bc05c", "value": "SecuriteInfo.com.Gen.Heur.Mint.Zard.11.12401.15851", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "913aebe6-c1c6-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1706876907, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706876907, "uuid": "17b2f974-4b18-412c-8b72-206995b63926", "comment": "Malware payload (Mirai)", "value": "811d60f8e3afdc61e3b37fdf3b94c70e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706876907, "uuid": "ebbd3db5-3c61-43bf-a413-0b2dd8a278d0", "comment": "Malware payload (Mirai)", "value": "6d98b2706f4b1454b9c6ed16c9bd4c9c6c53f57c31bcdc8bae4e61ace2d16b62", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706876907, "uuid": "4de28c30-5d1d-493f-a813-948146b87b2f", "comment": "Malware payload (Mirai)", "value": "6b852e1d23a538eb0c9736942505f99d6563551a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706876907, "uuid": "b1ffc129-ebfe-4dd3-a60a-4b0a3ce4ea24", "comment": "Malware payload (Mirai)", "value": "39a19d1553514dc2d0c4f6070a6f80ea0626fc84644b946ed5853cdaf0dcc54d636bcd28eb145e34a2be81af5785af59", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706876907, "uuid": "d29dcb5f-5136-46b1-959a-6cd816ea435c", "value": "T11CD31A0E6E618F6DF258877547B38960D68D63D73BF5C681E16CC6041E6038E682FBE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706876907, "uuid": "6f4f140c-a120-4414-ada2-fcf89523a4c8", "value": "1536:2g/w2jnILvAWgTarn2FxWxVowZWj4tp+7eO/UvTESS3x+Is:lweIMHTarneWxVowZWjUp+9KESSPs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706876907, "uuid": "e61a771c-dff3-46ca-a011-e7bd5efb0b88", "value": 135384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706876907, "uuid": "f3abdc69-700d-48d6-8494-27cfb6e517b4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706876907, "uuid": "b2edf0c8-0e33-4ea9-83ac-cf7b8dd80d1a", "value": "s_6d98b2706f4b1454b9c6ed16c9bd4c9c6c53f57c31bcdc8bae4e61ace2d16b62", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b86d2e84-c1b4-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1706869242, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706869242, "uuid": "18eb2a74-c33e-44ed-a55e-036c0b3a1bbd", "comment": "Malware payload (Mirai)", "value": "6970eb6d2f2aa2d8d39a2bf059507cda", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706869242, "uuid": "7e0adb69-1c45-4f01-903e-b08496e17813", "comment": "Malware payload (Mirai)", "value": "6ec34c39a28010125bb5d0d409a09babf8a390b373fc0f346560f09187de80d4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706869242, "uuid": "7504a3a7-8e00-407d-b3d5-6eca4486ecff", "comment": "Malware payload (Mirai)", "value": "157c211bf485c3a46768a0947ee13684e0829f72", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706869242, "uuid": "ac00587f-23b6-4ff1-9eeb-d5ceac69a14d", "comment": "Malware payload (Mirai)", "value": "134bcc514849918306c618920757c66346f70e76b71882d615b1d84d6b28318c469d020d479cba07e8492b28a8b3790f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706869242, "uuid": "3831a542-553e-4e0d-b409-5d4f2ab95413", "value": "T18653D616FF904FEBE85BCD3305AC8701399D685612B87B357A30C969F25E68F12E3894", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706869242, "uuid": "13130c9f-50fc-46c8-a40d-e9153d7d53d1", "value": "1536:ozcXv+9ccTWDlLAyjgp3LaODXwZYwVg04BQYs:owXv+9ccbDAEWY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706869242, "uuid": "b05bd06b-a8ff-46cc-811b-9b2175574126", "value": 64252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706869242, "uuid": "e99f5eb5-acb6-46f6-90a1-a3738f3f3f64", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706869242, "uuid": "7bd155cb-c893-4862-9d53-e4d7b38b2212", "value": "6970eb6d2f2aa2d8d39a2bf059507cda", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b186149-c20a-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Loki)", "timestamp": 1706905915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706905915, "uuid": "628d9743-b8cd-450f-8c50-6506d1c1375b", "comment": "Malware payload (Loki)", "value": "a6d082bcefa45fed06075e330ef4312f", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706905915, "uuid": "af222e79-4bd2-4097-b538-7450f739b0bc", "comment": "Malware payload (Loki)", "value": "6efeb7fabae9ed37e801f5ecb7aa26d95a69854c07b8360a096b5b61ed936e09", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706905915, "uuid": "2a176de4-f25a-43b2-af49-4319ce0c9bac", "comment": "Malware payload (Loki)", "value": "78981b47d1e17d4af4faf14d15f774cc6fd6d294", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706905915, "uuid": "446cb068-d08f-4f3d-b325-14da97266825", "comment": "Malware payload (Loki)", "value": "529b937dcce77453a7c4f045903803d0e775157a95370305875a8a9bf12fa9d43ead5f9a1ec0d811d0fc28fd312aae4e", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706905915, "uuid": "cb5d04ab-9bf8-4464-8713-ca21a3016562", "value": "T13A73716DD34B01598F525377AB1B1E5142BDBA7EF38452B1306C433933EAC39A1252BE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706905915, "uuid": "e6e98bc5-8b92-45f0-867e-4fe0944b3d9c", "value": "1536:EwAlRkwAlRkwAlR6n+7xb6W0QzLIS5CMUPCZ:EwAlawAlawAln7J0Q/IS5CMUaZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706905915, "uuid": "82e188a7-a4cb-4490-97ff-a2122ccf41d4", "value": 76506, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706905915, "uuid": "5225eb20-96fb-486c-b499-72476cd3f20c", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706905915, "uuid": "d2765ba9-5a94-4efc-95ae-7831a1842205", "value": "RQ-P0953.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebce45c7-c1ad-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1706866322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706866322, "uuid": "5fcfe654-602c-44e5-b77e-587cc66aec32", "comment": "Malware payload (Mirai)", "value": "f3275f5f4b29e221698af241e3bfad13", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706866322, "uuid": "375bfcc4-a8f1-40e3-998e-8ee3d2cc96f0", "comment": "Malware payload (Mirai)", "value": "709e2ce3b919396b340cac97973c53da6db6157db820690cc405ad0849860c27", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706866322, "uuid": "75b3fdac-9b58-4ea6-9a8f-7ad997642309", "comment": "Malware payload (Mirai)", "value": "f71561208156ed28dd8711784e4a5de8be5bddf4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706866322, "uuid": "633ce8e7-21c5-4489-bb18-9066cc788add", "comment": "Malware payload (Mirai)", "value": "4f0d0581aedd5269c55ac6af636353e0ab777c1f6a41cbd61c959d266bba639af48a9f05615fc9c0c8730ca222ce3f2e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706866322, "uuid": "bbed6550-d7dc-4eae-b363-71c295ad928d", "value": "T105330981BC829503CAD423B6FA2E01CD332663A9D1DF72579D216F5137DA82F0DBB652", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706866322, "uuid": "6459e26c-1260-42a1-95b0-d56e82c6c70c", "value": "768:BW+30Zh0VZfCNVe3ihNutPGUiu54yk1fg2KdfXgt+f3oiVUVZBNwyxUAFyw2A5E:Q+EZ2VFCzeeUiStaKdfXg4fYVJx7M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706866322, "uuid": "14c79b45-8dca-47b7-8e60-c6905e4938e1", "value": 54088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706866322, "uuid": "c9f17c13-bbab-46b3-9535-61b9cf6401a4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706866322, "uuid": "27b25240-17e7-45d9-9ed7-cf8dd6484e3b", "value": "f3275f5f4b29e221698af241e3bfad13", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc042e94-c1b3-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1706868872, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706868872, "uuid": "ddfd2152-f787-44e1-98a3-3e91e35aad14", "comment": "Malware payload (Mirai)", "value": "121fcb1964ec4d02159830ac6dfe5d23", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706868872, "uuid": "0e1c221f-4a1f-4500-837e-a481662950ad", "comment": "Malware payload (Mirai)", "value": "70ec004aff0c253235b3182155bc6b93976196755967cb1640d7007c2389d11b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706868872, "uuid": "b641d2c5-ba2d-4fc0-8cc4-8f4d2798cb06", "comment": "Malware payload (Mirai)", "value": "173cb09a5a3d7d23b83c6b29bb2add8216b65e1c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706868872, "uuid": "5a31237c-c975-4cb6-a3d8-532003017f2a", "comment": "Malware payload (Mirai)", "value": "57f18955b97a40e7af07f0486a78ac109860cfdf310d01b81121843a59f65545d4706586209ae9cc0b81f5a103b58ccd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706868872, "uuid": "f5cc6abf-b068-484f-b33f-360b643503e6", "value": "T171332A31B5624923C4D2593A12E7063AF5F28A8E5CF8873B7DD10F58FFA4A442193EE5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706868872, "uuid": "6d34d299-35b2-4d97-b70c-e8686b122298", "value": "768:L8fRFyblPS015Q+bN22Uf6hAPZO+75ezmsnc1tsI4:gfRQblPS015XcVB75eets/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706868872, "uuid": "4e772e9e-29ac-46a4-9da5-408e967c0c61", "value": 51528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706868872, "uuid": "e6b0b721-c87b-4ca9-9d51-1efe093b55c2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706868872, "uuid": "63871166-8b99-4949-bd3c-cb7eef6855cd", "value": "121fcb1964ec4d02159830ac6dfe5d23", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "591c22fa-c1b9-11ee-b7ea-42010a9c0006", "comment": "Malware payload (GCleaner)", "timestamp": 1706871230, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706871230, "uuid": "59faeccd-a542-46d6-97fe-d32f7f80bf10", "comment": "Malware payload (GCleaner)", "value": "9e2b1fa8d63e5d888a8652b2b9282367", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706871230, "uuid": "3ce664d5-91b1-45a5-ad52-2d265c190a4f", "comment": "Malware payload (GCleaner)", "value": "773fa89bb79908801969bb9c3555fd599615507ba557dc2aa3c88c1dc3a476f2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706871230, "uuid": "ee767393-86d6-48db-bb0e-d6c9dba70bb5", "comment": "Malware payload (GCleaner)", "value": "3fc7d0b2966d3ceae644746429187fc0e70d3e46", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706871230, "uuid": "149dcce6-eab9-427e-9f92-09c2e732809a", "comment": "Malware payload (GCleaner)", "value": "ff88e6f971dcf90a460e9b7a2f1c9da5781aae272d7218acf6028db1ce87b317be4227035de72c93635f7c441596eb8b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706871230, "uuid": "7bb4ce98-38c1-461e-b251-29c1587dcf49", "value": "T1BE44D011B5E2C47AC66B09B48870CAE41DBFB8767A71CD9B33683B2F2DB02D14656713", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706871230, "uuid": "d4483f78-53a0-4bb6-9623-4156fdd72a1c", "value": "4bd5f459ba426c2d24de507c1c6fab50", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706871230, "uuid": "50b420f8-c57e-49e3-89d5-1aeef5757079", "value": "3072:fLf/L9WGhh+7YxLrw7u3XtDVdC5GEsteN+b7iY9cFnX7L5IhnCZTG:fj/Lr+7qHwy3dh6Gq+b77UX+h8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706871230, "uuid": "4f348296-d860-4393-8dd7-eab5dbbcc6b6", "value": 262144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706871230, "uuid": "4c24f069-5c3f-4363-8b42-48f3756458e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706871230, "uuid": "ef5e4309-dd5c-47ce-a189-85855e9f0964", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4f7ab41-c18f-11ee-b7ea-42010a9c0006", "comment": "Malware payload (WhiteSnakeStealer)", "timestamp": 1706853318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706853318, "uuid": "ad3178cd-188f-4e08-aa37-fe5b32159365", "comment": "Malware payload (WhiteSnakeStealer)", "value": "b3b12faf689fe50c824ede1b6ef26c3c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WhiteSnakeStealer", "colour": "#B8CDAF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706853318, "uuid": "de625644-949d-4cf2-991b-4fb27c6a2e0f", "comment": "Malware payload (WhiteSnakeStealer)", "value": "774491da91b72ab7c52412cf1b2618cc5a97024fc2f9bfa763c076b0d9993b8b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WhiteSnakeStealer", "colour": "#B8CDAF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706853318, "uuid": "f35f7adb-3905-432c-8ff8-1f4316433a0f", "comment": "Malware payload (WhiteSnakeStealer)", "value": "5404f8748b1fe79d160d977263539de7308578dd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WhiteSnakeStealer", "colour": "#B8CDAF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706853318, "uuid": "62fa2461-7a2e-420b-8d65-43e285c9b49e", "comment": "Malware payload (WhiteSnakeStealer)", "value": "7378f785b33614952102ab465c225cdc498faf2a9474439e78ead0eb8e7e7beb16f13ff76a21ac093566357f2aefd0c7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WhiteSnakeStealer", "colour": "#B8CDAF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706853318, "uuid": "48188bc9-9175-4b05-a4a9-954795aa8aa8", "value": "T107C3E7C476C09722D9EE6E7CD0A35B1493B1910BAE43F34F2DADF1A50E523895A064BF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706853318, "uuid": "230621e3-64a6-4ccc-81e9-45436d11029e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706853318, "uuid": "8c5690cc-20c4-4a30-8c27-124fd84de2af", "value": "1536:mWRhs+k/FdcOjdluq00upzhj89bLZQb1QZtT08/8y8Bs6Q7eOW5bKLkL:ZkdSOJlCzG9bLZQRQ/4ISOcbKLkL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706853318, "uuid": "a4be1d88-59c1-423f-9b8a-ba10348750d7", "value": 124416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706853318, "uuid": "1d972cc1-3a62-48ef-9706-7e09559b51f7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706853318, "uuid": "3bcb348c-f87c-4c73-9862-c1d685746cad", "value": "b3b12faf689fe50c824ede1b6ef26c3c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f34838d3-c1b3-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1706868911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706868911, "uuid": "6eba9da0-1e9d-446d-9fc9-73ace2b68402", "comment": "Malware payload (Mirai)", "value": "4f0498a402f016fb835fbf4841b862fb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706868911, "uuid": "755d70aa-bca8-4df5-9e41-8f757230716c", "comment": "Malware payload (Mirai)", "value": "78c218ce217957b5ec0d0274031c866efb04792c603251456e3eec15ace768a5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706868911, "uuid": "3dc60477-f288-4694-9ca7-cb2e68646273", "comment": "Malware payload (Mirai)", "value": "b8ca85e2f02e7b323edfcfae58b28b29872c28e4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706868911, "uuid": "3bc64d1b-b8b8-4518-81aa-05d103c62ce4", "comment": "Malware payload (Mirai)", "value": "858f0e1e05751a6f2591f28472dbe5fa21d2e07857e3f1ed47ffb868b613ca0d276aa6a5f92dfdee9038d852b1830a02", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706868911, "uuid": "193a1246-6c3b-4baf-bff5-c19715bb94d4", "value": "T10F431A55B8814B22C5D512BAF96D128E332357F8E3DFB2139D202F603B8696B0E77D46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706868911, "uuid": "0a6bb97e-2abf-4c74-b95f-24ea38fce1f2", "value": "1536:Monaan3Kolm4IcHczRQAMF6inQDLQKAg:L8/DLQKAg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706868911, "uuid": "f9ef0a21-8ab4-4bd1-9ff0-57aa77f138be", "value": 59812, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706868911, "uuid": "8b808f54-f533-4384-b399-545148471030", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706868911, "uuid": "e6522b45-f173-4af3-bab0-d7b6b392c119", "value": "4f0498a402f016fb835fbf4841b862fb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6f48350-c17e-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1706846074, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706846074, "uuid": "476cfaa8-8c9f-42c9-a721-b694d6d8535b", "comment": "Malware payload (Mirai)", "value": "5814b4c7616e5801f3f28eb5f5264307", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706846074, "uuid": "f92f78ed-e046-4c9e-b8d9-8c3a44b8ed7d", "comment": "Malware payload (Mirai)", "value": "795bc61583e212a19906d56b4232ff3eb27bb2951d22685e1f5c1bd987f76891", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706846074, "uuid": "ca289a59-00d7-41fe-a7d2-f6b63f0b2592", "comment": "Malware payload (Mirai)", "value": "0d9b9f91b512d20e8072004333bac4473378b4c5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706846074, "uuid": "8252471e-834c-404d-8199-a0715b6510f1", "comment": "Malware payload (Mirai)", "value": "1272210aa96bc2238993763af6c31c4a75ec16c69a01637989d77224b39e3f34c06c1f245f0a8dffb1cce887e1da2a1e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706846074, "uuid": "ccfdb857-8b35-4e55-8ad8-774745dfb682", "value": "T1EA53F85AF981AF01D4D522BEFE4F11493353676CE3EE71129E215B2067CAA5B0F7B802", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706846074, "uuid": "84824d91-7f99-45a4-88a2-41cca2b39c8f", "value": "1536:4bnLKAu4lNaYZyUIXrUZV89ScHdDytlGr9luyi6DzIqS:c1umNaNXwD89ScHdDyiWeDzIR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706846074, "uuid": "34faa215-6590-4cd6-b43f-d1c6a99338ce", "value": 61972, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706846074, "uuid": "e5345678-541a-4d0c-8797-fbd027289a30", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706846074, "uuid": "c1ee36e3-ca9f-4502-870b-2faec9cb9165", "value": "5814b4c7616e5801f3f28eb5f5264307", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b41c216f-c1a2-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1706861504, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706861504, "uuid": "bff5c5fc-932f-466f-83c0-253097e8b1ce", "comment": "Malware payload (AgentTesla)", "value": "afeb846add958a10881534f1c7432c8d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pif", "colour": "#A6A680", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706861504, "uuid": "4e586a1b-0c93-46e8-be99-e35f1a13d9b8", "comment": "Malware payload (AgentTesla)", "value": "7b62fd54154e6ac5e545c1850a3a4c3a92b28f862e951c1bd36fc57ac5e89b3e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pif", "colour": "#A6A680", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706861504, "uuid": "ae074a65-3005-4745-a778-b6f7cf48b772", "comment": "Malware payload (AgentTesla)", "value": "5504b1021721cadbf71f2d5e6ba7f261dbe6ec9c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pif", "colour": "#A6A680", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706861504, "uuid": "99609ded-3996-4d08-9b7c-82908d036810", "comment": "Malware payload (AgentTesla)", "value": "2ca33f54834827846ac2c7191c59e851e22acf1a6f67efb3bb5995e8068555fcda0c363eb3b5f4c453486292d768b313", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pif", "colour": "#A6A680", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706861504, "uuid": "f577417d-8e87-43b4-9450-a48be8371cc2", "value": "T1FF15BE9C3650B6DFC957CE32D9A82C64EA60A476530BD203A05316EDDE0EA9BDF141F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706861504, "uuid": "80f85b19-4539-41b3-b1d3-6016fbb4f1cb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706861504, "uuid": "1cc18556-e41d-4405-bd85-edab4e527ec9", "value": "24576:5rDhVmQvuh8bshSqkOqdY/xweGkI0NgTKjB:BzPb5+/xwHv0NQ2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706861504, "uuid": "9c820fbb-38d0-4a63-84e7-ac42d255fbd6", "value": 914432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706861504, "uuid": "7aec65db-fa02-44a1-80ad-d2994e8074e2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706861504, "uuid": "a122a6c6-3c5d-4c61-a14c-7569f70264dc", "value": "0001.pif", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd426f63-c209-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706905784, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706905784, "uuid": "f5174379-b339-4bd9-9b5a-539371a4a558", "comment": "Malware payload", "value": "eb8fafd991000e3ac23a961d523fc5f2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706905784, "uuid": "2ce0dd5a-eadb-4ef0-a534-f4809668e82b", "comment": "Malware payload", "value": "7b7c07623e8bd124b2b760081ee1c8ca1595eb38fd94a4d640c30fa83a934e3e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706905784, "uuid": "2321e13c-9cfa-4399-b922-f2e403afcb7c", "comment": "Malware payload", "value": "82e38cc7323f3b2c26bdd74ca22dbabb0a1172a5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706905784, "uuid": "869789c9-d9b9-45b5-95e1-3695d960ab94", "comment": "Malware payload", "value": "a40946e39ebe93437fe853043470da9ce53503b528115a590c7fcce177e975010a6af6d0fbbd9c917fffba3c795d1afe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706905784, "uuid": "0e39d632-e30f-4163-9f97-f5d9ade9a626", "value": "T139B6125C695E6276C1A21EB344E5911E042BFE7D339E10E3328DBE5E493F5E22633632", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706905784, "uuid": "889f184f-9a1f-4932-b344-466a9f5e77c2", "value": "e6f01faaa9110a45e79c07e7ed4ea951", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706905784, "uuid": "7037fd0c-27f5-43c0-b41c-b3715fa65d79", "value": "196608:V3BgagtDIELFNZX7q5cyskN999ZxNjxabWtqFLX2mLbYwlesUrho8:pBZmsELHecZkDJgFFXYqUrhr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706905784, "uuid": "18adf187-e43d-4ab0-b8f4-a931c2eef0ef", "value": 10447592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706905784, "uuid": "98a428b2-dbe9-41b9-9f0a-f6e442016c9b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706905784, "uuid": "11760f44-9fcf-4bdd-8ae2-147843d222cc", "value": "SecuriteInfo.com.MULDROP.Trojan.25729.6999", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef920da3-c210-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706908848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706908848, "uuid": "34b6d0ad-dd27-4389-b0fa-c59d0d9ca652", "comment": "Malware payload", "value": "957537119d1d808725d08308b0189a99", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706908848, "uuid": "c12040a6-5dfb-4633-85be-9b9f4b40b967", "comment": "Malware payload", "value": "7bdbf20eb742e859dc999d8b31f15900c8c7a55d14fe93e283cac6dda3ca2137", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706908848, "uuid": "dc069a07-81b6-4ad2-a223-adebe2d527f0", "comment": "Malware payload", "value": "ad323601b5ada9b142273189cb63519265427ff1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706908848, "uuid": "cd15419b-6c03-4281-8c6e-bbcb0b7ef932", "comment": "Malware payload", "value": "87391b99de58e6867c780b07d108087cbe51502beab415c592544856f28c4257a13510f1d82cbb08060e80bdd58fa5be", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706908848, "uuid": "c9f54127-4ba7-4d00-8fdb-b9f02b6213dc", "value": "T19A26C046FF498E56C3AE6F77C2D2401443B1D48B5363F70B2B9923B5190372A7D8E68A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706908848, "uuid": "99ae7b2b-6f1b-4da6-bc29-374ad4ccf8b4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706908848, "uuid": "9f7c4055-05f0-4fae-b52b-e20f8e8a5e59", "value": "49152:N7CfKCu9sD+yw1LviJw5ReL+2QyLG48aSYHtDRPGUHFv/3+iUD0pdSdvDtrm:sfK6RKvieCL+HyqeVbPGoN+iUDgkd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706908848, "uuid": "d2ee56d5-84b8-4fce-8a65-a8c928cdf733", "value": 4819456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706908848, "uuid": "42849787-56a1-48cd-a774-dd2a209b769f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706908848, "uuid": "d2d0b4d1-a253-4c62-825b-ee851860f95a", "value": "957537119d1d808725d08308b0189a99", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03874593-c1df-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706887407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706887407, "uuid": "5be3832f-a6f5-4fcc-b493-582dcd5a4080", "comment": "Malware payload", "value": "2f72be01870ac0b3bc5f5b570e6359a8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706887407, "uuid": "17199dcd-da2f-4ee0-83ef-e15ab4618dd2", "comment": "Malware payload", "value": "7c497795a7d3b6d41197040270eb440e2528487c91fd1f4d633fa0f1c69dbe90", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706887407, "uuid": "30669952-9ca9-426a-bdff-2a8175699b4a", "comment": "Malware payload", "value": "df98437c18c317daa016e6d833ce9a3aafa0e0f9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706887407, "uuid": "2f2d2a52-2c73-420b-8f2d-736f0832e04d", "comment": "Malware payload", "value": "1d3f517745f850057526f9396c26150e8f1fab6fcd024fa1c93133935cad20ba2f44a4f6c7358cf35b78e60411aadc01", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706887407, "uuid": "84c786b7-d74f-43c3-9a57-3d891e51e751", "value": "T116144BABAEF3B051C9A6047B503233A27762EA4C4338E0E374746D5D78657FA9B312D4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706887407, "uuid": "48dc7b89-5056-4ae1-b05f-f04c76e85e2c", "value": "3072:nnn3Ym/vxma/oIQP09VSI5zp5XRERghCcQTBfXB9Oxa:3Ymca/or0uI5zpVRN1QTBfd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706887407, "uuid": "80df6405-98a7-44d7-8793-3a0691e5de1c", "value": 204800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706887407, "uuid": "bd42b628-910f-4227-9c27-60713843423b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706887407, "uuid": "4cca4ad3-d83b-45d5-9f6c-064e37194075", "value": "SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.25514.2474", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc36fa57-c15e-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RedLineStealer)", "timestamp": 1706832366, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706832366, "uuid": "0e18be19-d621-4de6-8c82-f986b023b643", "comment": "Malware payload (RedLineStealer)", "value": "63d9528b6667199d22c482f15643ab31", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706832366, "uuid": "068124a2-04d8-4530-bb5e-47dfebd292ba", "comment": "Malware payload (RedLineStealer)", "value": "7c94846904eeffd843980d64ba0eee3b8a81a52aeb60b5a5195bf7b426e4a443", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706832366, "uuid": "e6d30341-27af-4052-b5b6-6e463e5165ba", "comment": "Malware payload (RedLineStealer)", "value": "6b6ee0d6d1d661dc3806b653757c5fa8fbc7fd36", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706832366, "uuid": "5aa98b71-b407-4e1e-851e-43ee31fcc2d2", "comment": "Malware payload (RedLineStealer)", "value": "9f8b4a5cb64f0b890940cd57c80b0446d8e4be7d1e88cd0ed58ab2583368f8748681341a267700b5c77eedd10874979f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706832366, "uuid": "252b0106-7f7d-44e3-ba16-52c99b16117f", "value": "T14BD402217A81C1B2C4B7243084D5C73A5A7970714B2681DB77DD2BBB6F223D5A73A2CE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706832366, "uuid": "4c389bc9-cc0a-4653-8b74-ee741c1e593c", "value": "bf5a4aa99e5b160f8521cadd6bfe73b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706832366, "uuid": "ed7acd03-fd3f-4aa3-b8c0-6b49bd8a1994", "value": "12288:gh1Fk70TnvjcU72Em20lUIIgp05m/x979RE/UzIB8Irh:mk70TrcUSEHIIghREMyld", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706832366, "uuid": "2802b3a8-7db2-410a-b024-dd789adb58a9", "value": 610048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706832366, "uuid": "86e941e9-be0e-40bf-a8ca-767e13ee0afd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706832366, "uuid": "ddc8f842-3cdb-4b7f-954d-8358e77550b3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "069eb0ac-c1cb-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706878822, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706878822, "uuid": "d95f5fad-5769-41cc-a267-65a6afcfc3ef", "comment": "Malware payload", "value": "6b88cce2883cc6dc59824d7d38c0d4c6", "object_relation": "md5", "Tag": [ { "name": "discord", "colour": "#27793F", "exportable": true, "hide_tag": false }, { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "EpsilonStealer", "colour": "#559F06", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PlanetsTherapy", "colour": "#A55C4E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706878822, "uuid": "91e5f093-7785-4e6c-b169-86307ded975d", "comment": "Malware payload", "value": "7d73101f85b350cc3ae53ed3ca40ca7b22772244db03f54ec4420e469f385714", "object_relation": "sha256", "Tag": [ { "name": "discord", "colour": "#27793F", "exportable": true, "hide_tag": false }, { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "EpsilonStealer", "colour": "#559F06", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PlanetsTherapy", "colour": "#A55C4E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706878822, "uuid": "839aa0f4-c081-4a6e-99c0-540ceda0b205", "comment": "Malware payload", "value": "135aa59c0794747db5d8d386039a6e66b1d34c56", "object_relation": "sha1", "Tag": [ { "name": "discord", "colour": "#27793F", "exportable": true, "hide_tag": false }, { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "EpsilonStealer", "colour": "#559F06", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PlanetsTherapy", "colour": "#A55C4E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706878822, "uuid": "48762865-ffd0-4e78-b579-3014978432c8", "comment": "Malware payload", "value": "dadd50217f454a94d6e4885dee19d8704c073d2e4d9b690d02d00f9145ef8ce9b01e309029a7f2482625b0d7febd88a6", "object_relation": "sha3-384", "Tag": [ { "name": "discord", "colour": "#27793F", "exportable": true, "hide_tag": false }, { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "EpsilonStealer", "colour": "#559F06", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PlanetsTherapy", "colour": "#A55C4E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706878822, "uuid": "bcba9f15-1802-4538-854c-b9d18c1364d5", "value": "T110E733DC30E0E86BCC91083ED37DD59AD24113C3B591ABE13F26CA9935538768E25B7A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706878822, "uuid": "4d3e2b52-11fc-4cb3-a763-193ba2cf856c", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706878822, "uuid": "149201db-1a26-4614-bb6a-847fe7b3957b", "value": "1572864:Qm6smM8akdHWjcbuobCTBYCByJUi3YXQH8xvPAfD1WneNIYk:j6smXddHtaoiYLBoXQGODIOIYk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706878822, "uuid": "b8df17b7-f224-4116-a83e-f9dbb2c45168", "value": 63935629, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706878822, "uuid": "3849c9fa-bde3-4299-9967-547bad7662c0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706878822, "uuid": "54905d1a-3e6e-48e8-85f5-dad09b40f04a", "value": "Planets Therapy Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f0249ad-c16a-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1706837363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706837363, "uuid": "9db8b48b-f338-4c06-875b-61d0b5c75bb2", "comment": "Malware payload (Mirai)", "value": "fa7364ad7e21d27533c089dae1e6e230", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706837363, "uuid": "3ff8fe5d-58f9-4dd9-a493-a90691a0fa6d", "comment": "Malware payload (Mirai)", "value": "7df53c5c88af15fe72a93b745bcd7f82e4a921fdd4ded9f09949b700fcd5d0ad", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706837363, "uuid": "7f573ff8-1e9c-45b1-8f6b-ff589a0d1031", "comment": "Malware payload (Mirai)", "value": "b3b750be07fffcd761feb39868a55f61a88b4a97", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706837363, "uuid": "87b6d56f-9deb-4fd1-b6a2-74e673ff582f", "comment": "Malware payload (Mirai)", "value": "76a301e11068a21f082998398b0ce63751703702904eea0402be21605d9d99ee6ee73ee912b2e01fef67462b1d0cca5a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706837363, "uuid": "e7c236e3-8c9b-42c7-94f9-8ba940971d42", "value": "T14F535921797A2F17C4E8A07A25B38315B6B5768E32B8C65D7C732F4EFF14640A0075B6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706837363, "uuid": "4f40c030-8c23-4d71-bf80-f7746a7fc61e", "value": "1536:k+YY8/acYmgBOwicSYmnWLI1fz/A0LzpLpdYm+K:n2DZYmnFxoYpHr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706837363, "uuid": "917a68c0-ffc5-4247-9328-8bb9c19f7d86", "value": 64400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706837363, "uuid": "2bcdf5c7-fdcc-4705-a26c-f9f2f99c7b4b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706837363, "uuid": "3b401a55-1f9f-4d96-8420-0ce829cb7f8b", "value": "fa7364ad7e21d27533c089dae1e6e230", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b62503c4-c200-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706901880, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706901880, "uuid": "b1a7796c-c541-47fa-9725-4e1babe8c55b", "comment": "Malware payload", "value": "78b0fc6af84c789a39ca74b3ab9f88dc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706901880, "uuid": "7048c573-77a9-456a-b318-de3f11177af6", "comment": "Malware payload", "value": "7ed95ba34ca8cfc40494ca5fb3f9c4253190eaf6dae23c99dbce8c1c55f82b3f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706901880, "uuid": "14f2c29f-fd9d-4325-981f-14c883012267", "comment": "Malware payload", "value": "41e2185fec61608e3321ab485edc9ba50601bb59", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706901880, "uuid": "91deeb24-454a-4d51-a5a8-cdea7dfe3e27", "comment": "Malware payload", "value": "008b94e15ac85260b42402d11585ccb4e8f07d65eaceb690b9fbfd7cf99c9928629aae0be32e7ecd6e88f47dfb03fbf1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706901880, "uuid": "1d9c7334-ecea-4cb9-a6f7-9391e712ad6b", "value": "T118157B13B3C7C0B2EFA226F6D67453361939B839173C85CB7390287EE9906C1AA79355", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706901880, "uuid": "cc03a6f2-2bcc-4cd9-b7a1-ccd0739fda94", "value": "8d813561e4ad07e9f8918a83e16f95c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706901880, "uuid": "e5d8cadb-f7bf-4fed-8e14-5c084444cb13", "value": "24576:N8w41MYT0mWFR6DeLC+pjJT5cA60UhthO:Q1beL/xJtcl0UhtQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706901880, "uuid": "8c0bd35f-2e7b-496d-9b5e-bac5e4008022", "value": 898048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706901880, "uuid": "2e14e1be-46a3-4a3d-a610-acb5c0774286", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706901880, "uuid": "2dfebb7d-51ff-49cf-92c6-f9eedfbb50a6", "value": "SecuriteInfo.com.Trojan.Script.2622.21183", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad03d43f-c1c8-11ee-b7ea-42010a9c0006", "comment": "Malware payload (BlankGrabber)", "timestamp": 1706877813, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706877813, "uuid": "2aa3ee30-d4c2-425a-bdb1-336786bb456a", "comment": "Malware payload (BlankGrabber)", "value": "9774138ca2204b1d56443c87c92c10a2", "object_relation": "md5", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706877813, "uuid": "76f8a9f8-e620-4e5b-bbb3-99a0a65c06ba", "comment": "Malware payload (BlankGrabber)", "value": "7f0301baa35f103a9019c55ec5c2707c5b999e34074a336927d93179a097a969", "object_relation": "sha256", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706877813, "uuid": "9c359680-4ee7-4b63-b6e1-b1facc64a9ee", "comment": "Malware payload (BlankGrabber)", "value": "5a811058a5dda2ab30e3b05264b3db1193308082", "object_relation": "sha1", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706877813, "uuid": "2c4556cb-c9d2-4aae-bf3f-dbbddee2c466", "comment": "Malware payload (BlankGrabber)", "value": "71800c554e6dcca1129c198706b14191b5f0ec89a9c166d2cbc8207c9e5c4f465412a0b13f68fc8ddbecc4733eda9a1d", "object_relation": "sha3-384", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706877813, "uuid": "58cf7261-a77f-4bdc-bde2-3c2fb52b7d5f", "value": "T1B4763311B3A558EAF992923EC5C6C612DB333A5513E0D18B07A84B721F272AD4C3BF57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706877813, "uuid": "9834e813-5eb7-464f-995b-2fdf4609b1c5", "value": "20d446c1cb128febd23deb17efb67cf6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706877813, "uuid": "afff96f4-affa-4386-bfa4-1e79d2a1338b", "value": "196608:0ugYS6AcROshoKMuIkhVastRL5Di3ue1D730G:gYSeROshouIkPftRL54fREG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706877813, "uuid": "89aa0809-c824-43ef-8752-753057159a46", "value": 7675579, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706877813, "uuid": "d37d1335-0c65-494d-9cce-6787bb88fc6b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706877813, "uuid": "af780926-c432-4358-8643-48cdb9e5171e", "value": "SecuriteInfo.com.Python.Muldrop.16.12472.10612", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c52be91-c1bc-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706872551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706872551, "uuid": "03c42150-4eb2-4631-88e7-bf0ee41d672a", "comment": "Malware payload", "value": "02ffe4613f2c4a9d1085d33c5ce9b34b", "object_relation": "md5", "Tag": [ { "name": "discord", "colour": "#27793F", "exportable": true, "hide_tag": false }, { "name": "EpsilonStealer", "colour": "#559F06", "exportable": true, "hide_tag": false }, { "name": "password-protected", "colour": "#3D71D4", "exportable": true, "hide_tag": false }, { "name": "PlanetsTherapy", "colour": "#A55C4E", "exportable": true, "hide_tag": false }, { "name": "pw-beta", "colour": "#37A355", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706872551, "uuid": "cdcbfbef-935d-4af9-9848-49a325766174", "comment": "Malware payload", "value": "7f9e0efbf75d0913470f65f7662d4a10f203d5b56e47179cadbf755ce3c98da9", "object_relation": "sha256", "Tag": [ { "name": "discord", "colour": "#27793F", "exportable": true, "hide_tag": false }, { "name": "EpsilonStealer", "colour": "#559F06", "exportable": true, "hide_tag": false }, { "name": "password-protected", "colour": "#3D71D4", "exportable": true, "hide_tag": false }, { "name": "PlanetsTherapy", "colour": "#A55C4E", "exportable": true, "hide_tag": false }, { "name": "pw-beta", "colour": "#37A355", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706872551, "uuid": "160b2a11-988c-46ff-91b2-35a47d21eea5", "comment": "Malware payload", "value": "c46954707052dd4165255b8c71cc1fe537660839", "object_relation": "sha1", "Tag": [ { "name": "discord", "colour": "#27793F", "exportable": true, "hide_tag": false }, { "name": "EpsilonStealer", "colour": "#559F06", "exportable": true, "hide_tag": false }, { "name": "password-protected", "colour": "#3D71D4", "exportable": true, "hide_tag": false }, { "name": "PlanetsTherapy", "colour": "#A55C4E", "exportable": true, "hide_tag": false }, { "name": "pw-beta", "colour": "#37A355", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706872551, "uuid": "eaa27f9b-dee4-41bc-b5e2-04a291e62620", "comment": "Malware payload", "value": "a576f269d7d63f60c8da15c84c1bfeee9ca67329c31f69c0475d0af37a18c3bb0b6b91c30968c34feedb9a4b8653eb77", "object_relation": "sha3-384", "Tag": [ { "name": "discord", "colour": "#27793F", "exportable": true, "hide_tag": false }, { "name": "EpsilonStealer", "colour": "#559F06", "exportable": true, "hide_tag": false }, { "name": "password-protected", "colour": "#3D71D4", "exportable": true, "hide_tag": false }, { "name": "PlanetsTherapy", "colour": "#A55C4E", "exportable": true, "hide_tag": false }, { "name": "pw-beta", "colour": "#37A355", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706872551, "uuid": "bfdda48a-8e92-4694-8f31-44b9c93dc3a5", "value": "T1F7F733EAB49A847794B2EC048F00A1E15B74C3567EBD27C4E498E68DB646FF87493343", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706872551, "uuid": "04e5b5ee-13ec-44a1-a2b9-f3e41851d8d8", "value": "1572864:x/48jxc3p9++H0t4o+iYDaziAFTOVUeGkuYvOYfsbCwgUtaaU8t:x/kXne+x+ziA9WUetvC+etaaU8t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706872551, "uuid": "ff305ee6-9573-4cc0-9396-35b975b5d285", "value": 70311938, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706872551, "uuid": "0bc42a46-3034-4952-9265-139d705fd297", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706872551, "uuid": "00b0e34b-08a0-4dba-bf00-74befc5fb257", "value": "PlanetsBeta.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7ef5e5b-c1c0-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RiseProStealer)", "timestamp": 1706874476, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706874476, "uuid": "06806d68-6729-4071-a7c0-c15afc8a0ce4", "comment": "Malware payload (RiseProStealer)", "value": "7de366bf40d96088d70067f5c277dd4e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706874476, "uuid": "d80cc51b-ff71-4a61-b964-573cc59e5239", "comment": "Malware payload (RiseProStealer)", "value": "80825adf522373ab075d5b7992982146eda44e61030d2ec7216aad7ba614fe52", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706874476, "uuid": "7fa7b27d-4263-48aa-b7fd-d60866181601", "comment": "Malware payload (RiseProStealer)", "value": "4565bf43679c7ed2835f615fcd99b15ba4ca783e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706874476, "uuid": "beb128fb-e328-4100-af8e-ccd07dee6127", "comment": "Malware payload (RiseProStealer)", "value": "cc05fccf318ec9bbaf97fe5c58278e4fffa6d817821d10924367fab32c54286da07ffd4d9b6873b528b8617ca44d3bde", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706874476, "uuid": "4a1e951b-280b-4626-9fcd-f089a367df75", "value": "T1A7B533F2CA761656C67F73BB34779B1A07932D1F564022BE2A83F46047FC235896AD08", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706874476, "uuid": "99f944ca-ec37-4940-925e-3afd34a6ad91", "value": "baa93d47220682c04d92f7797d9224ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706874476, "uuid": "9e6f7ec8-7d3c-4be6-a392-0cca80f9d171", "value": "49152:+xTWgmLa13eU7KxmGPxw2YVDFgmcgxYN:+xigoaNPGYVFO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706874476, "uuid": "c1f3ff45-20ba-40f4-bbc6-5dcc1b034d2d", "value": 2344448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706874476, "uuid": "f04aeeb8-723d-4a37-869d-4ed66b08e380", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706874476, "uuid": "bdf53987-e826-4817-ad96-90d955019761", "value": "7de366bf40d96088d70067f5c277dd4e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f352e4c9-c199-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706857745, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706857745, "uuid": "ba4624bd-0fc4-4d47-b4f0-e9ef46c05601", "comment": "Malware payload", "value": "813e164615e9f351b4250ff42c0c5ecb", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706857745, "uuid": "a40741d0-057c-48c2-9e58-e6744b40a67a", "comment": "Malware payload", "value": "8168f6d79d5162697bfc4cd9f2afa8d08119f01af170cb44979d03d858020da1", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706857745, "uuid": "e653f70d-c04c-4644-99f8-3335d36dee3a", "comment": "Malware payload", "value": "fa0fa3b995343fe057086f18857a2c161107f3aa", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706857745, "uuid": "89ddead3-3104-4b2f-92cd-6da10b7d236d", "comment": "Malware payload", "value": "570ee9321bf151585230698bc9b39c67c9630cf84683afd25f62f72de01a15f5d61c81933fbe59dc5c3483eb5badbf7a", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706857745, "uuid": "bbcbb140-4a80-4e9f-bd3e-7a4447826c32", "value": "T13F544B746BDFE651F9376CBECA105A180C12569ACD028B89AB8FFDE07707464162FCE4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706857745, "uuid": "d7efcfa7-1c81-4e42-bb0e-6e695c594882", "value": "3072:fMWoyzgU55Zg3sj4ob93zZroxhTrbqVDkgm6PHwQ9CzBSp6BTuVCQAMhNPxX7/UP:wvUDa+e8C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706857745, "uuid": "972ae11f-dcc5-4d3c-8050-d89e9633e6d0", "value": 293653, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706857745, "uuid": "c16b3c4c-85f9-4a60-b401-4105a3e21ce6", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706857745, "uuid": "ee966eee-51b5-4dd6-85a6-4d52f3dc0b0b", "value": "Blu On Hudson Restaurant & Event%0D%0A Hall Report.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "056a4d22-c1e2-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RiseProStealer)", "timestamp": 1706888699, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706888699, "uuid": "bb4aa7aa-0f91-48f1-9214-8c5b1bd1d531", "comment": "Malware payload (RiseProStealer)", "value": "ba909a0337ac4d31ad7567ab68294060", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706888699, "uuid": "151ea779-f94c-4184-9543-c039b0d9ae56", "comment": "Malware payload (RiseProStealer)", "value": "81c8321034f1bdeaeac76bc581d66e4b8ad682ea131af98ab6e25a6fd9d1693d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706888699, "uuid": "68f72784-eb84-4a09-a639-01d1d2d6e29a", "comment": "Malware payload (RiseProStealer)", "value": "0682c54d3c5db449451af068649b6397ba5b03a0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706888699, "uuid": "ada4c1b0-739e-496d-a63e-05c8dfdffaf0", "comment": "Malware payload (RiseProStealer)", "value": "b8dbecd1860260eb74813750e19e9db828cc4408bc21e04b5e4448155fb55a75b65ac87fd6e93a71c2c6d183ef3b0383", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706888699, "uuid": "fffbe866-e461-439b-a686-b4a5bb7ae33d", "value": "T169C533213901C277E4AD403450D9CE39DFB874A35B6BC5D77AE8476A7E283E1A6383C9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706888699, "uuid": "8cf18c4d-be08-46d3-ac43-6458e9f898c6", "value": "bf5a4aa99e5b160f8521cadd6bfe73b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706888699, "uuid": "215973c6-bbf1-42bc-8036-6befe02fb8bb", "value": "49152:XkQTA5YpMQNglRqKxPNBl9+tNU/K/XK4PIWuCWqgF0wAtZAuYI4n/rb9xp:XaaBPKRNBr+XUUZIW3WHF0ZtZAuxeb9T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706888699, "uuid": "c540ac7a-5805-44c8-b389-0893ab73ccd5", "value": 2560768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706888699, "uuid": "d6cf7102-c205-4ec2-a259-95e4f494a422", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706888699, "uuid": "aa531297-06c2-430e-8ed2-95ff4e5e8241", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b52c9cfb-c200-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RiseProStealer)", "timestamp": 1706901879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706901879, "uuid": "7d05467a-e7a6-43de-85bf-9f01f7e8d92d", "comment": "Malware payload (RiseProStealer)", "value": "c15bd26876e849bb5611113ea26c5487", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706901879, "uuid": "f05b2259-7604-4ea6-8fdf-393f7887b8ef", "comment": "Malware payload (RiseProStealer)", "value": "826a58e28716f97ac18d99160e98d5fab2ff915b54f56af03a98f001d4d98f28", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706901879, "uuid": "64aa40be-57e1-488a-ad67-32c53dd508f3", "comment": "Malware payload (RiseProStealer)", "value": "409046c04e0fa69dd8e605c9d4d9d949c73e5a45", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706901879, "uuid": "48f4b8b7-a97c-4c6d-8d55-6b184297ccaa", "comment": "Malware payload (RiseProStealer)", "value": "04fd7b848e71f3f42b6f25118b0b88c94686034785619ae7b27978cb2295bb90ccf4e9a7e16a71a4854156e556d28cad", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706901879, "uuid": "cd01cbc2-630f-43a5-b3dd-0f20db08b5c6", "value": "T1F0B533F49C711195C3DB5B3949618F9D29ABEE2B6000A07E0592F99E3F3F538CA27D41", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706901879, "uuid": "41edc8d0-b876-4d08-a275-c272998a102e", "value": "baa93d47220682c04d92f7797d9224ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706901879, "uuid": "55103a91-0349-4851-b0c3-7449155f2a7b", "value": "49152:BSFWnr9hhHl/6uKNb7gszf7mSzRDPGDth+9wPINrN:BSg5vl/6uKN/Vzf7mUyZh3PIxN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706901879, "uuid": "9eb3fa89-489a-4fe6-97a7-fc9ab57c614d", "value": 2329088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706901879, "uuid": "8afd3f23-dc29-4b4d-9150-d1996898c44f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706901879, "uuid": "cb56d61b-d79a-4443-91d4-a79e2e692fc1", "value": "SecuriteInfo.com.Win32.TrojanX-gen.30216.13774", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ba9297b-c164-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1706834673, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706834673, "uuid": "df16f34d-0c8d-4b43-ac4a-a5ea39ad794a", "comment": "Malware payload (Mirai)", "value": "eec1bb66d1caa3658a878b2a3fa7a257", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706834673, "uuid": "e27c6bac-3ed4-4d8d-a81c-cc3876dadc44", "comment": "Malware payload (Mirai)", "value": "826f34909a17bb1bddffd472b2e7409a8dcd1128b4aba1d324cc75e8719078f9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706834673, "uuid": "859c42ef-54be-4b12-983e-0abd26e7e264", "comment": "Malware payload (Mirai)", "value": "de2bb93409e3e292869da3952a6e66fca692a4ec", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706834673, "uuid": "254f1ee2-3478-4606-9cd5-58c8104583ee", "comment": "Malware payload (Mirai)", "value": "d139dddd6ec73a9a8c90cd3eee830594bd159eca30d60a03992ba29b028fefdd3d230c85a920e212f541ebcddf043f61", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706834673, "uuid": "13fc97eb-bf45-4b89-8307-2e0ae02fbcac", "value": "T1C2433B03322C0E17D9A21EB0353F06E093BFF95126E1B68A254FDB664639E7615C2F9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706834673, "uuid": "40c6e4a8-2e7a-43a2-be4d-1c8621cd871c", "value": "1536:1t1JILhthQ+1r4atGKmifAKWNGa/d42+8/:1ufh/w4AK+GaP/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706834673, "uuid": "e9ba6851-5e9a-4ac9-9891-cf197b6efb02", "value": 60040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706834673, "uuid": "314e7367-73cc-4dc0-9365-aa55710bda57", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706834673, "uuid": "c70c4afb-27ca-4d89-8683-a02e6dbe16d9", "value": "eec1bb66d1caa3658a878b2a3fa7a257", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0118c628-c1ae-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1706866358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706866358, "uuid": "479acab6-8a68-43f9-99c9-05eb59baa504", "comment": "Malware payload (Mirai)", "value": "6c98a6637157a1c30e18390f70f0903b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706866358, "uuid": "8a03aa3d-b6fc-444a-8d1c-2106c944e86c", "comment": "Malware payload (Mirai)", "value": "82b81925dd3a7b19f1e186177201fa9cac5a804563155cfd2b37170c67cb1fb4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706866358, "uuid": "84eaaf9c-1221-48ea-973c-87187aef5e9d", "comment": "Malware payload (Mirai)", "value": "ec6c1c6ac20f43d14e14270f923142aabb3f22d1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706866358, "uuid": "83a63fcb-2581-45e1-bc32-0df416ab5fc8", "comment": "Malware payload (Mirai)", "value": "f79c40450fa50565d170e2c784f9677f9c2fb44ecab738c4e0c163a754bad9c044dccbc6ff12c5b0cbf5bc804362ce53", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706866358, "uuid": "ab4ae73b-c44a-4f19-8850-a0b7a85aa205", "value": "T16F73830ABF650FF7E8AFCC3789E91B45248D641A21993B797D34D818B24B24F49E3874", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706866358, "uuid": "af1954d4-aa98-4122-b56d-f6007d43f58c", "value": "1536:vGFfut16/jhZRcogB2UHFeZMDuPSwtOA3B:+Ffut16LhLgB2UyO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706866358, "uuid": "c52b5e22-93d5-407d-bd3f-9d4bc28fa292", "value": 79884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706866358, "uuid": "2a0d8131-8551-4ef7-bff4-c5dfd6bbbf51", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706866358, "uuid": "32ed972d-ce51-4dfc-8ed8-029b903bb639", "value": "6c98a6637157a1c30e18390f70f0903b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "512c569b-c192-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Amadey)", "timestamp": 1706854466, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706854466, "uuid": "16db108b-3729-4f7a-bb4b-c9608f080359", "comment": "Malware payload (Amadey)", "value": "f35b671fda2603ec30ace10946f11a90", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706854466, "uuid": "df086ecd-17cb-4938-952c-81610b9fefa1", "comment": "Malware payload (Amadey)", "value": "83e3df5bec15d5333935bea8b719a6d677e2fb3dc1cf9e18e7b82fd0438285c7", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706854466, "uuid": "0bf02e66-39a6-4e51-9ad8-8373384a0759", "comment": "Malware payload (Amadey)", "value": "059ad6b06559d4db581b1879e709f32f80850872", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706854466, "uuid": "75a82475-adb6-4477-820f-8baeb36344fd", "comment": "Malware payload (Amadey)", "value": "a5cc46f20004c1ce4fb2bccb5a8de957290307ecd6a78843b7fffb843175ccc2f065bed03c7b84a8eda22cb5756d148b", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706854466, "uuid": "375b95d3-6cbb-4a6b-bda7-46120ab5b1b4", "value": "T1AE557C0FA26541BCD4BBE1789A135947E775700603709AEB07E446AA3F53BF1AEBE310", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706854466, "uuid": "6bb8802d-f181-44a8-9f83-cd27ce141c44", "value": "3eb70f83441fc8632e81bd6eb89f424d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706854466, "uuid": "8ffef86a-5d0f-42c8-bfb2-892e8aada64e", "value": "24576:2vkQL6YY4wMPSYZofkf0Gh6Pi41+a9uyP5dggv4+yC7:2sMPSYcS5wPi095PbgS4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706854466, "uuid": "184265ae-79ee-49f6-aa85-b48efc8eb687", "value": 1285632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706854466, "uuid": "7a5e0a30-74ca-4465-b42c-e08e31c59646", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706854466, "uuid": "808b17b7-59c8-4f3c-8166-ee8010bbf3ec", "value": "f35b671fda2603ec30ace10946f11a90", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa76dc76-c189-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1706850885, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706850885, "uuid": "f6dae90a-d33b-418a-ad69-b4452d08d53d", "comment": "Malware payload (Mirai)", "value": "ccfd364956150a64bf1cb9103b3bbf67", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706850885, "uuid": "f562fa1f-468f-4eaa-88b2-9197e6e65332", "comment": "Malware payload (Mirai)", "value": "848fe803302c0d5c9abe95afd19c3d577974e7a70851af1ca382ed184c18689f", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706850885, "uuid": "f55039e3-6b65-4ca1-8518-530ef2b04fd4", "comment": "Malware payload (Mirai)", "value": "b1b8c2ba96bca9aba8cd17b6f70beafebd75dcd2", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706850885, "uuid": "124a705c-0729-4923-8928-a36f10b999dd", "comment": "Malware payload (Mirai)", "value": "0d9c7ef804b6804d2df014b2665913249c4a6863f7aaadde8cc47ea5f009383c2fd3b3abb81efc34fd8668dc6783fcfc", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706850885, "uuid": "2539315e-beee-4845-912a-855fed2f2cdc", "value": "T1B9E34A17B1C188FDC4DAC1B44B9FB636DD32F4AC0238B16B27D4AA262D5DE205F5EA50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706850885, "uuid": "1244c652-ee88-4efe-aa79-4e33488b8dab", "value": "3072:RcJhERRmGSJYo5yL78cEn1sPr+5sSxoJqFyBzzNsTy:RcJhERRmGSJld3iz6Ty", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706850885, "uuid": "0aa6257e-38f8-4b33-911f-e55a11c116a3", "value": 153752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706850885, "uuid": "7f512aa1-8a05-4d8c-9161-effbc22322fb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706850885, "uuid": "7c2a8472-0ab6-46aa-9f0a-54fcb9ed9658", "value": "huhu.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f54efaf-c1cb-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1706878971, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706878971, "uuid": "e8cae0e2-a6b0-49e3-b9f7-c24eece778fb", "comment": "Malware payload (AgentTesla)", "value": "593bb72286c1c2ce5c2456c7d9585a80", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706878971, "uuid": "72170d99-b051-480b-8ed8-34f45c2fa98e", "comment": "Malware payload (AgentTesla)", "value": "84f0a1001a606072b86d8eca2c4d9ccefc71c38ff71d0aaa2f4ae003f802917b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706878971, "uuid": "2bbac37d-fde0-4ab6-bde5-2e782bb2e046", "comment": "Malware payload (AgentTesla)", "value": "cb9bf63f9005d5b4f1bcbcf3efead399a1c960a7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706878971, "uuid": "a8b8e1c0-29ad-4474-85c5-a17b1c8949a0", "comment": "Malware payload (AgentTesla)", "value": "b5bb71bfe22183228c4ea3419226e6075dfcc303cefe3a9cd329492244d6bc7d848e3cc6840679de8da8b01885a81812", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706878971, "uuid": "0daf4015-8f82-4ffa-9e0e-0fe169ecacd8", "value": "T1D5F4128136BA5FE2C17DDBF825A5858117F23A6B4521FB0CAEC771EF4826F120711A27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706878971, "uuid": "67de2107-102b-46a6-a044-2011d03dff99", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706878971, "uuid": "3fc353df-be6b-4aaa-ae81-5190d4adfb34", "value": "12288:gOd53rD22AAxia+iWUd1jIXbsZ9uXIfa5vWwRkP/l14zAFDQzjgWaqPK6k3LlYl:NrDa5a+iJXIr89fOmnnDQf4bP3LlY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706878971, "uuid": "9aca034e-5857-4592-a9dd-40b243197170", "value": 730624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706878971, "uuid": "f7a225f7-aa1e-493a-949c-70136fb7b5c4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706878971, "uuid": "19c19835-0b55-47fa-a781-6289488efcef", "value": "nOrden de compra.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f52cad89-c189-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1706850876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706850876, "uuid": "b0281ea9-ae9c-4232-9ef2-282826c4087f", "comment": "Malware payload (Mirai)", "value": "4c749a73d551aa02b56a77774065aea6", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706850876, "uuid": "b72e242b-f7bb-4490-8917-42bc88f6b582", "comment": "Malware payload (Mirai)", "value": "86f6a6bd3790227a9def3d974e8a0d2acc00ec95ba4cddc9cfd0826512dcbaba", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706850876, "uuid": "e6786b57-f150-4d7d-b520-49bf66fe8bf4", "comment": "Malware payload (Mirai)", "value": "97b769a1f8fb8ad41bb71cbf3d6721e1e6d5db27", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706850876, "uuid": "b47cc337-3a62-493c-b37a-34ad693baf97", "comment": "Malware payload (Mirai)", "value": "c6299aebc6606a2753e2c5884c105bad9d71f5799abc0a5eeb527b66bf6180fb58abcbcdfd68dcfc2edd6b4276735fa3", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706850876, "uuid": "5b92d54a-0810-4bfa-a147-e3f60c59f243", "value": "T1D9141A45EA414B13C0D627B9F69F42453333AB9493EB73069528AFB43F8679E4F23906", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706850876, "uuid": "b147e6ed-2ed8-4b26-a93e-262c23ffb32a", "value": "3072:MxPy7EoGLXE+u8BRIvabJh+o0ReKFtLBJdEO/v5oFM/RNuQVwKJ:yy79+uUWvabJh+o0oUBDEOHeFM/RMe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706850876, "uuid": "5c120962-c804-4cbd-a157-533f0d8a3c25", "value": 196812, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706850876, "uuid": "af0cd41f-9054-4453-8548-0a4aefd2dfc8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706850876, "uuid": "8f92e0b1-4441-4460-b651-5fcfeabb8d8a", "value": "huhu.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb512ff3-c196-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706856443, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706856443, "uuid": "5162c19f-f7e3-419f-8140-4e63af62750e", "comment": "Malware payload", "value": "3b0d0a7e728aa516281e751fdddf57df", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "Bitter", "colour": "#E509A8", "exportable": true, "hide_tag": false }, { "name": "chm", "colour": "#080B02", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706856443, "uuid": "0a32cb02-2cf7-4812-be98-db35f991baac", "comment": "Malware payload", "value": "876122fcc9e0d5ebd42df9e93d37ad23d9f521e6077e9cb8b05862ae157757e3", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "Bitter", "colour": "#E509A8", "exportable": true, "hide_tag": false }, { "name": "chm", "colour": "#080B02", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706856443, "uuid": "d1d3eb54-0000-45fe-bf84-993bd85167e2", "comment": "Malware payload", "value": "f68285cea41de3333b1521ac8c358231ea6da23c", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "Bitter", "colour": "#E509A8", "exportable": true, "hide_tag": false }, { "name": "chm", "colour": "#080B02", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706856443, "uuid": "fdcd445b-c74d-43a7-8c31-ea3036733219", "comment": "Malware payload", "value": "3a900e23319cd313bd342e7eb6b9a85ef105059608b3929cfb70b32031aa99670715ee8c186ebd2552513c0d4df3ac57", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "Bitter", "colour": "#E509A8", "exportable": true, "hide_tag": false }, { "name": "chm", "colour": "#080B02", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706856443, "uuid": "d0d53235-23d7-4143-a936-1e195d0c3604", "value": "T108325CA82B304511C4E58837EEC39A8ABB37BC52D564814A231677FC06F9B4C67B54AF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706856443, "uuid": "4f345de4-7f37-4efc-86e5-4975161f396e", "value": "48:cDe/gB09I00QRlEFlErlElm5s12gA7CATRqQC+QqJz7S2l/jfVA9WhQLpS8Cr5pv:IeNIUWAWATRjqq9Zg9SOs5p5/pnDjiC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706856443, "uuid": "fb19f0c9-6d0b-46bd-95a7-786909c44ae8", "value": 11258, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706856443, "uuid": "b298a4ed-3e90-4ce2-ac9a-c2eb05330373", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706856443, "uuid": "2a913e8d-a933-40d1-a525-59fdbb15dfce", "value": "20240123CN-ENG.chm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd4f203e-c1ad-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1706866351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706866351, "uuid": "2a344111-a10f-4818-9fbd-794ba9e503d7", "comment": "Malware payload (Mirai)", "value": "9f8135c093dca4129658f58ad7c300cc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706866351, "uuid": "edf13935-c133-4b04-927d-8923fa4b1402", "comment": "Malware payload (Mirai)", "value": "88c598e3b900558262b597b5d47882ef93b4f4ae94c525603a5b28e7605d8efe", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706866351, "uuid": "c9ffa1ca-3052-46f3-ba98-00e961b7ee8d", "comment": "Malware payload (Mirai)", "value": "b61cac6c7e98405b5b4047719f925a633677268d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706866351, "uuid": "ac5e6c93-6f2f-475c-8ac0-075d77f86c0c", "comment": "Malware payload (Mirai)", "value": "004d683cc20898a86e635be6082e6ac267757c2a2d0820c44df54ae1be265fd84d338fd8f246948389e6a3793e8c2493", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706866351, "uuid": "3ded9d9a-fc09-4246-b6ee-d079c6923d6a", "value": "T170338D73C42E7D94F14AC278B9204B385B23D50696833EF5968AC6974047EECF6593F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706866351, "uuid": "4f517e64-f905-4902-80ef-02ae09f58698", "value": "768:T3/zTfpYtWja5FLM5a0wtAmb8VjqZDoFKGFIPxCilrSeN74utCZAoqrcCILCEa:T3/vpY6OMa0wtAtGoA6I5PtSgtiIcCI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706866351, "uuid": "436bb5a3-438c-4fdf-bb99-8e0e23c9f83a", "value": 54680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706866351, "uuid": "f4565cea-3772-449c-afac-4b97c48717a1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706866351, "uuid": "4204ca5b-70df-4f0c-966b-aee01ae1cb0b", "value": "9f8135c093dca4129658f58ad7c300cc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b4b8c0b-c1b6-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706869838, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706869838, "uuid": "f6968b2c-63a7-49f9-bcc2-34f86ffbdbd0", "comment": "Malware payload", "value": "250b75722e9fa525abfd686e2a9d97c9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706869838, "uuid": "9fdbfd8a-06e0-4315-b027-4c2500cb237e", "comment": "Malware payload", "value": "88fcfb4aa99e99cb38660d6346ce989abf4569019cfd58cc762b6314a7c1f7e9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706869838, "uuid": "9e2b35d6-aa08-403f-a049-14a6011bc1df", "comment": "Malware payload", "value": "7aff4a592edc79af89c088d8de76b86abf741e18", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706869838, "uuid": "c1b9c927-5e84-47c4-9f2b-bec5920ce6c7", "comment": "Malware payload", "value": "8c80138d1c2760fda30f919a7846a6ff6246c5ed0e7126c9537c9f8d5ee7c191a7a952deff26dfc7641a8df4a5c7c674", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706869838, "uuid": "752ab49d-2e11-4fe6-b0b9-552a706e5c4f", "value": "T18A673398F33CD731E63B06BC2F6CE21922266C2917FC9D2E62487E1872761AC5ED4547", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706869838, "uuid": "463ef0e8-62fc-4dfd-b42a-6546a3f16680", "value": "c05041e01f84e1ccca9c4451f3b6a383", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706869838, "uuid": "634b9bec-154b-4c1c-8324-167f6575b9eb", "value": "786432:6xIN9h44ibT+oork0pUI1qbc2Mgfg3LoSFJgxwd5QLT:6yV4hT+C2RTjJgOun", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706869838, "uuid": "23f8b8ed-4149-4741-8ece-a31780ec3d82", "value": 31458744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706869838, "uuid": "8d97c980-edca-4a95-86a7-87790eabbc48", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706869838, "uuid": "3f2b079d-4e0f-4db6-89c3-78356bf4993c", "value": "SecuriteInfo.com.W32.ABDeceptor.UWIJ-5466.17598.7735", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06d866f4-c1f0-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RiseProStealer)", "timestamp": 1706894714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706894714, "uuid": "decf3e86-b201-43fd-a267-83791f0154a5", "comment": "Malware payload (RiseProStealer)", "value": "37fc3dd6a8899c9219c25700b4db20d2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706894714, "uuid": "f2e67b8f-a6c1-4786-a0cd-1a02239600cd", "comment": "Malware payload (RiseProStealer)", "value": "898ad6a3cac77014d49f9ced657769e1bcdfb1107eb9930d28e9fa780c5aed90", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706894714, "uuid": "b718ea36-6876-47c3-a4ae-9b25be4fcfee", "comment": "Malware payload (RiseProStealer)", "value": "5cdda7d3d699f49419a02fddcc419289b5b7341b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706894714, "uuid": "d67a8e49-1dd9-42f6-8416-ef75a2f4992f", "comment": "Malware payload (RiseProStealer)", "value": "2ea464f90b2745c92075d22ca009e4f55c745e296401ea6e27eea27a0ad3eda9b78c8839d97396c97b19e47d7b9539f5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706894714, "uuid": "caa82aea-1907-4483-ac2a-e79760aab3ba", "value": "T1D4558DA2F45E3DF4CECC517E01CEF4BD544220DEAEC7D2EE09D1E796B4D82A9AA11844", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706894714, "uuid": "90899e58-860c-4dc0-ad8c-d4b9e00bebc0", "value": "bcaada7db1c3b7a0077de29a4546c424", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706894714, "uuid": "a156664e-37bc-4d08-892e-d05d0d8921af", "value": "24576:x6ghgbF4M2uorYEpldGlPOrY4I4oLrCytnXXXXkcp5r5su9ivKXsPLakwQbftFu:x6UgJ4M2uorY5NiyGakwQbfa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706894714, "uuid": "64f40192-d9b3-4e91-95ba-71b09c7461d1", "value": 1376072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706894714, "uuid": "abd5a12e-b623-4091-bee1-39a2bc19a622", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706894714, "uuid": "03fa1925-440f-4921-9958-7b56292e68aa", "value": "37fc3dd6a8899c9219c25700b4db20d2.bin.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fda42603-c1de-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706887397, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706887397, "uuid": "e17731d2-e525-4fb3-a188-0847b17c4c04", "comment": "Malware payload", "value": "f3621dbbc29cdc484a36bebb35ca047d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706887397, "uuid": "447a4e6a-5bc6-4c6a-ad07-2ee96b6eee5b", "comment": "Malware payload", "value": "8be4e448650a18ce001e4fd67e9ee94220fa4f2852ee0d38c2890c1c4fc0d0f3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706887397, "uuid": "07af3dc5-4714-463d-b16c-2e1405ed1cde", "comment": "Malware payload", "value": "9b8bacf598d6f6cf6f160cfa74538a1f064424c5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706887397, "uuid": "87cbfb89-87de-4f66-8e24-9ed8211cbed1", "comment": "Malware payload", "value": "1d5d4b7fbbac43eef6ed26d73cb6198925db0e813ec955fe69c1b446cc1b440c62a4a58ca047262f83ade01b19b86b86", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706887397, "uuid": "cbdaec1d-158d-4729-829d-60487389040e", "value": "T1FF83E713ACC24878EA4080F1C3281DF91763EF5B2735ACDB97D0B9562A753E2D533A66", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706887397, "uuid": "9466d15e-75ad-4b22-9e57-57a1525a7c8d", "value": "768:tBk3wdvUUa7g58oxQ+t7mUFMbF2G8m4caBCDe3Ze5gicVHaQORb8Ol:t3TN7mUKZaADe3w5MtkRDl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706887397, "uuid": "5654fbc7-df61-4288-ac3d-00379fadeb54", "value": 86016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706887397, "uuid": "607f08c0-8ee3-46d6-af55-c375c610d918", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706887397, "uuid": "ec6e2764-877b-44ae-882f-1eb8555b3106", "value": "SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.1289.9739", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "955b9e54-c21b-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706913422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706913422, "uuid": "a9658cf8-420a-4040-9aee-dc1f82cb083c", "comment": "Malware payload", "value": "29c6e64351e49c360d252d6aa4d5fdc8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706913422, "uuid": "870cad9e-0326-493e-ba49-2b1fef9cb30e", "comment": "Malware payload", "value": "8d0fc5466871d00f5e11f077b7db26a4e828ae9d8479daab8b1ff490d05e3e5f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706913422, "uuid": "c7afff84-5ccf-4cc0-b977-379d7c1c1eae", "comment": "Malware payload", "value": "bf4cf848f31040a5f499929d537d411c4cdaebd5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706913422, "uuid": "8fb27dd1-338e-480e-b5a0-ce1c62242c22", "comment": "Malware payload", "value": "3a9b55a925e463bd9919a61ea17f9ecc1a16696bc85adae0861b7f3cc07102d5454b173ce912935362060e52bbd22759", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706913422, "uuid": "5e700b73-a8c8-448f-94f8-63ad11a1d48f", "value": "T1EAB533E98AF25E56D11317F9009781C61F17CEA3D080899D2578F462CB3DDBE86E1E2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706913422, "uuid": "98acab8c-6205-4d35-8d35-dd90691cfecf", "value": "baa93d47220682c04d92f7797d9224ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706913422, "uuid": "2b8b0ff0-dabf-4c29-9c95-f8641003f8c8", "value": "49152:AmzJduWhho8nFOTr8jHgQFPX5xhAEt0hRq7P:NJ0WhrnFOEjHLRt0q7P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706913422, "uuid": "945178bc-bd78-459d-98b6-b1a6b7d73f81", "value": 2310656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706913422, "uuid": "6cff1c85-858c-4580-8cd1-b0746a9fcdd2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706913422, "uuid": "c73d5166-7de0-49ca-8b65-18db9744d475", "value": "SecuriteInfo.com.Win32.TrojanX-gen.17964.23581", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28a239e6-c20a-11ee-b7ea-42010a9c0006", "comment": "Malware payload (GCleaner)", "timestamp": 1706905938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706905938, "uuid": "cbd67742-fa48-4ceb-b28a-b52ca08b082a", "comment": "Malware payload (GCleaner)", "value": "9421bb65a9d5ace737e8ebbb04986873", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706905938, "uuid": "3a10a89f-3b31-439c-8b60-2abc83cd8106", "comment": "Malware payload (GCleaner)", "value": "8d2a28f4d0d93aaf2e4dedf67b40ba16a68026a27e8b70ab1e82bf244d533682", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706905938, "uuid": "3cf108de-3a7a-49e8-8bef-c1c91922d63e", "comment": "Malware payload (GCleaner)", "value": "9be0ea2b3a272e31d95572d88703926dffb9818c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706905938, "uuid": "7290928c-ec4f-40c9-9579-afbb226f22b5", "comment": "Malware payload (GCleaner)", "value": "55c1bb86758bafa26be2e9fd3313591af571abf9094b6bb9213dde9ef90f6b9b0e228b51ed6e680b373ca40b1bd7c1cc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706905938, "uuid": "1f4170a7-7ac6-4459-ad29-d2e73c71bcb3", "value": "T1A3348E1175D1C832D472113209E4EBF65A3DB8310BA699EFA7D41F7F8E702C1A731A6A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706905938, "uuid": "f6accb6d-56af-4cdf-859a-956cf30ec0a3", "value": "485c402695cff95cd57df5b99f97c30f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706905938, "uuid": "2a46fb28-7326-4215-8249-c22be543f4ee", "value": "6144:xowKY/ICXEroFNbmQMbcBt2+ieJBEuwAOCcOwc:xowKY/zXYoFNbmQMb0kuwkcJc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706905938, "uuid": "a2505cb7-a351-4c8a-906d-c35256253030", "value": 240128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706905938, "uuid": "2cab3fb2-9b8e-4984-93d6-304f7cffb267", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706905938, "uuid": "ba0eecfa-f01c-4686-9d55-864f627d646d", "value": "9421bb65a9d5ace737e8ebbb04986873", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea8703a3-c189-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1706850858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706850858, "uuid": "9465374a-0504-4a39-b48f-2b3c153befc2", "comment": "Malware payload (Mirai)", "value": "00774e629b1cb6edecc6577d38a3f891", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706850858, "uuid": "48f83ca5-c77b-4ea2-bb77-065ccd7fbcba", "comment": "Malware payload (Mirai)", "value": "8f92792529bfd310e454df8e1150639afc74dd8aeaf9c1bcde609a8659d54c38", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706850858, "uuid": "90e6e987-cad9-4071-868f-6cbe98b0374a", "comment": "Malware payload (Mirai)", "value": "5c0d464dbc1bf786c42b61f3a5cb96b2de015ca3", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706850858, "uuid": "38a0626d-58e8-4922-94f1-260860720c70", "comment": "Malware payload (Mirai)", "value": "f0615bf8b4e5c6cf23dabc681076ffcbf072c989a063cf8df597aea71723982a045938ebfb1f2c569c9ab71f4b82ec79", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706850858, "uuid": "4af4e95c-4fbf-4b0e-9631-a9e07705d3a6", "value": "T1FDA36CC0F683D4F2E8435575707BEB329B32E0B9211AEB42D3A95E32AC51451DA1B7EC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706850858, "uuid": "bf555909-9fa6-40f9-8566-b4389c736afc", "value": "1536:jViv1BjqPZ9BmxNZPyQ08u2a+ZBG+Z44DlV7PeXCgW7GYS9rZA1XoFQ0L:cv1BjqPZ989Lfa+ZAQrloXC/qF9cZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706850858, "uuid": "d97ac609-f090-4ce6-ad11-831e67b8134c", "value": 103720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706850858, "uuid": "a58d6988-0587-43b1-aba9-b47ad48c119e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706850858, "uuid": "36253588-82f0-4369-91e5-6d0cf75a0d74", "value": "huhu.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24abcc30-c1f8-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706898200, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706898200, "uuid": "9683fe27-e240-4f04-8d04-24094aba6f08", "comment": "Malware payload", "value": "2ed4b311420b27fd35abb943558b7165", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706898200, "uuid": "326143ce-4c7c-4019-a006-c7d8d1e96a43", "comment": "Malware payload", "value": "8fb2900936ea5b26a4444cd2667932e0566fd7ad3af093850d5be28becbf77dc", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706898200, "uuid": "5b23e45b-dc51-4fc6-8040-b79e0756b0f9", "comment": "Malware payload", "value": "854c2044c2c808eabdb25b4a40794906b32ecea5", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706898200, "uuid": "5e20a25b-a967-48f8-8d90-92b4713889cf", "comment": "Malware payload", "value": "7771f00353ac5fd048fe7618835291540847e7dcb9595fa99fe323bce4fb645273854b364673469a5d99c1a413c3ce7a", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706898200, "uuid": "22701c55-0ead-4cf7-853e-1d9f8ac12d1c", "value": "T16F5393B0D6765EF0DEBE25FA10A7B24B11F0B757B241D7590DD2A0EB8392E807E40AD4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706898200, "uuid": "81f4f9fd-3201-4cca-b0a5-592de87e8bbe", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706898200, "uuid": "88ad19c8-1407-453e-9ef5-6565ecaa680f", "value": "768:JrvJNllHeNxxqp5lhZ5M3i5YkziJAGVHAJllaH6HBHbJnw2JfleYkcHAHdH+HkHY:FJDMSr2JYJtJ3JGnLf49xtEmPK+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706898200, "uuid": "26dab244-e874-4c5b-a210-63b0c96e3c95", "value": 64512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706898200, "uuid": "d98f4170-d784-4fbe-8981-24747592f2a4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706898200, "uuid": "81e1e672-c8eb-4f93-bf42-480f62b7041c", "value": "SecuriteInfo.com.W32.ABRisk.PHDM-1697.32602.3126", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9639b9e1-c1ad-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706866178, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706866178, "uuid": "0f321233-65bd-446a-9534-5f4690d76f0c", "comment": "Malware payload", "value": "a7e03db70c5e7f151e441b13bdc26337", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706866178, "uuid": "d993c64e-d5f0-4933-b63a-3e682a97fd6f", "comment": "Malware payload", "value": "90f23514ec917dc8bd3e8459ba37630d8f8ae2eb2056bf4aecad6509295a6d77", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706866178, "uuid": "9873d622-5ede-4bcd-ac30-fa72c5aa1c50", "comment": "Malware payload", "value": "c96bf9be32112d53babf5df0c6f20064077b0f56", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706866178, "uuid": "ad6ac8c8-2476-4911-a22f-7b2e824c0200", "comment": "Malware payload", "value": "2146331d46af81266787b2be6d2a0d17f43aedc789aedff5a244e5f14cac29f03387d34c6b073c7e748288802e18489c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706866178, "uuid": "03121307-a616-4038-9260-e58feb9f5067", "value": "T123F63921350AC435DA1252F199297FEF43AC8E295FF45AD7A2C41E7E5CB01C32B36E26", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706866178, "uuid": "2bda3e5b-6f46-4d7f-93d4-ae02d4528ec0", "value": "235ede2c75bc884e08fcf8f1f5333e6f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706866178, "uuid": "3bf44e31-7ec7-4f3b-9653-6db3b086df52", "value": "196608:O2rXwiB0WvmPbe4eqXRBF6AvSDtqHZirlqfzDam0tmbWDzm:frpvafnRBFstq5w0flyzm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706866178, "uuid": "a2c25e2c-9ffb-4f7d-8bc9-7d333b2e25b3", "value": 15901696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706866178, "uuid": "3e4c81dd-6214-4e34-9b37-effb0881ed8c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706866178, "uuid": "c51c7c2a-58ba-4fdf-8523-0790df1aacc6", "value": "SecuriteInfo.com.BScope.TrojanDropper.Dropback.21973.24305", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3bbf0d1-c1c7-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RiseProStealer)", "timestamp": 1706877449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706877449, "uuid": "85958e0f-ff50-49a0-b8d9-a93ce0f2cda2", "comment": "Malware payload (RiseProStealer)", "value": "992033958cda7a40755eb253f4053cc7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706877449, "uuid": "a85609ea-5044-4a95-94b2-849022dea637", "comment": "Malware payload (RiseProStealer)", "value": "917358d5c2468b323d4cfe966f4f18bb0d4b24c81eb5c70b18347a28f668f8ce", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706877449, "uuid": "f38d0ae6-7184-436b-99fb-80ac44f7d591", "comment": "Malware payload (RiseProStealer)", "value": "fdb0e54245470964d045add72029aa6f82f8ae2a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706877449, "uuid": "d067ed17-f0d5-4c97-82e5-0e2f5ca7920f", "comment": "Malware payload (RiseProStealer)", "value": "39568ca5b9ff2e8e209bf5837c84e3b2bf07b7032ccb8d14c6f0738911bf22e6af46d849af948ad7f1324dabde914cfe", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706877449, "uuid": "e3a4a1b1-f9d5-4613-a810-c766632db231", "value": "T15AB533F53437270AED174BB8F328160A86137DCB25409A286C08F193E7FF63979A5DA5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706877449, "uuid": "db4cf180-2866-40ff-932c-cf32ef0ed039", "value": "baa93d47220682c04d92f7797d9224ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706877449, "uuid": "e92f3a8a-fdf6-4985-8353-659658c21773", "value": "49152:fKrCuFr1on4OTKWdVgjHL8SzgA66nFpt0O+U7WWc:fQknDHduESzH9mU7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706877449, "uuid": "25c254f0-58a1-4027-be3e-a7fe326b9246", "value": 2335232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706877449, "uuid": "85f95381-03c0-4b01-8b13-269039d18274", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706877449, "uuid": "0241ebe0-d159-4847-981c-1757b787641c", "value": "992033958cda7a40755eb253f4053cc7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16d798a9-c1a6-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RuRAT)", "timestamp": 1706862958, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706862958, "uuid": "65beed8e-d225-40a5-a640-b2074b204e67", "comment": "Malware payload (RuRAT)", "value": "075d6c122274cb9226521d3cd298f2f2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Remote Utilities", "colour": "#145F0C", "exportable": true, "hide_tag": false }, { "name": "RuRAT", "colour": "#03BE1A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706862958, "uuid": "c0a9e7fe-bd45-4130-9b25-8bc4100d6050", "comment": "Malware payload (RuRAT)", "value": "92192af947017c20ad861faf4459fb705e63f7083b34c77c1727891b88091573", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Remote Utilities", "colour": "#145F0C", "exportable": true, "hide_tag": false }, { "name": "RuRAT", "colour": "#03BE1A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706862958, "uuid": "2464ec7f-fd89-4ce2-b6d4-34c00bc6157f", "comment": "Malware payload (RuRAT)", "value": "6f54d70f39fa28596ef90bfcb0c14278b016db1b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Remote Utilities", "colour": "#145F0C", "exportable": true, "hide_tag": false }, { "name": "RuRAT", "colour": "#03BE1A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706862958, "uuid": "69d7ea65-018b-4e88-991e-316168f3b61e", "comment": "Malware payload (RuRAT)", "value": "aff69dd8ea741dff0ac8e2eb26f8c5db463eaa5e8a8a48120c59669097fa9b14b6c73d850475af98e6347fbbbe5be4f0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Remote Utilities", "colour": "#145F0C", "exportable": true, "hide_tag": false }, { "name": "RuRAT", "colour": "#03BE1A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706862958, "uuid": "d345ec25-8026-45e8-b917-b14284b4f291", "value": "T114273306D79D18FCC8A9E67D985B4C47E633784D2211A48F176949A22F83334ED3F72A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706862958, "uuid": "60ccdcf3-7ba7-45f3-8632-2aad52cb6817", "value": "b1c5b1beabd90d9fdabd1df0779ea832", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706862958, "uuid": "baa32ccd-1ca8-4ccd-8aac-66a5ec9f5d96", "value": "393216:9Vz6+gdQzi/Ew1x1vXYQBEPDdasNaAzEFuEaP3CxMk50pRZfQCy0lifWA5J8EOx:LHSvI+EPDdXNaHaP4Mk50hfh/ieA5nOx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706862958, "uuid": "9b57386f-935d-41ec-9b59-59a9b57f6b77", "value": 20949417, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706862958, "uuid": "be6ed7d5-8120-4df7-be1a-27e7cbb34aa7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706862958, "uuid": "14674e47-18cc-4021-b658-31822e150eb4", "value": "3_\u0420\u0430\u0445\u0443\u043d\u043e\u043a.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfdb327f-c1b3-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1706868879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706868879, "uuid": "e1775598-9974-4fc0-9cbf-b730cbd8e40d", "comment": "Malware payload (Mirai)", "value": "1ad2de2add0bf9177d55276ab9054da7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706868879, "uuid": "68f3ed05-9aa6-4d57-b814-9f2eac817af9", "comment": "Malware payload (Mirai)", "value": "936543f9b9b3d30de8b97feb17338177b233c07cd4d91fcd744a48bf7a8fffe9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706868879, "uuid": "a44169fb-9598-4a01-8792-9d1ddfd3a783", "comment": "Malware payload (Mirai)", "value": "c31c14d5259c6c4f490192927a69db69d5783e18", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706868879, "uuid": "3132c94e-f028-4bce-9a42-1d945cfac06c", "comment": "Malware payload (Mirai)", "value": "91fd3b495b5dcbba308d1fc8b52d01c25178add9578789337ab0982bb9ede7f3a170d0ff0eb6456e6eb01402d569028d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706868879, "uuid": "634dd9d6-6d5d-4490-82c5-6fc94ec95889", "value": "T1E5136C76D42A5E54D0460170B860DF780F23E0C193676DFB2AAAC5A69487E9CF918FF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706868879, "uuid": "c4db1ecf-68c6-4fe9-a024-c32e90a10fbf", "value": "768:nZISg3TfWLSmH5QzXON92MC0omvrJFnhOtCu2w:nZDg3TfW+1E92MMcItCuv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706868879, "uuid": "290a00a5-b797-4c91-8fb6-44cc7621ed6e", "value": 43940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706868879, "uuid": "e3aafd2a-bfac-4ab8-bb21-7be829484c56", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706868879, "uuid": "aab7ee5c-41df-43ad-8630-340c10edfe5b", "value": "1ad2de2add0bf9177d55276ab9054da7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e983336-c1a0-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1706860367, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706860367, "uuid": "18309331-7a61-483d-bc40-6f11f762e03a", "comment": "Malware payload (Mirai)", "value": "7d1be207fdd2bba2cb9d497195612674", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706860367, "uuid": "4c2d3c52-2f26-4bfd-8af1-7e74027e1c40", "comment": "Malware payload (Mirai)", "value": "95cf6750860468354b9bbaa85063147221182fbaf0e4b8634a1db554bb720a18", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706860367, "uuid": "6aa28d44-0567-4069-9cab-c7fcd0e1c957", "comment": "Malware payload (Mirai)", "value": "fdcfc09992836da49eb4e48fd3b688e1a25ebe99", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706860367, "uuid": "fa3b779f-24f6-47cf-b2b8-6fbaf7125c5e", "comment": "Malware payload (Mirai)", "value": "b7a6249ce80fc22c27cd97d73ea075e8e7d4c5012250fa4a9a474f753a0eb9c4480e4289fa19b0e5a4f750f312d64be6", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706860367, "uuid": "ea6be6da-ff4f-41d2-8f2c-f0687c3e1a7c", "value": "T11933180BB59284FCC15CC2746B2FBA3AD936757E0239B2A677C4FA266946E301E1F504", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706860367, "uuid": "356dcbad-0f93-45f0-9b26-04ff96d986c9", "value": "768:oAvo3AkuNns9OIQNhTe+i9U5qvquVTWbplS3ucs3HY730BJEA4NMMB:bo34Ns9OIQHTe+i9U4iy0Dc/73QOj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706860367, "uuid": "6e6c5033-d334-4137-a1db-359dce00a9af", "value": 50336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706860367, "uuid": "193a6514-14f0-425a-b70e-4869a02afe9a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706860367, "uuid": "953cd1f7-d33a-4913-9b6e-f45d4740ea9f", "value": "7d1be207fdd2bba2cb9d497195612674", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7026798-c20d-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RedLineStealer)", "timestamp": 1706907519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706907519, "uuid": "b726b235-6065-4545-b209-5afdd8bb8026", "comment": "Malware payload (RedLineStealer)", "value": "7639916444b9e57d68f675fad6ad98c6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706907519, "uuid": "ee40f9ba-1450-4779-9109-1ff66afb9f0c", "comment": "Malware payload (RedLineStealer)", "value": "96c6b02661c3fa2177213fc855a7f85a309d58467036e8f592c0809b5236e323", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706907519, "uuid": "3da7c86d-435c-41df-9239-00e1d200b5c9", "comment": "Malware payload (RedLineStealer)", "value": "64d813014dfab1904d74de0846664b3c3b1d298f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706907519, "uuid": "93051a83-14c2-46d7-9f87-c512105dc049", "comment": "Malware payload (RedLineStealer)", "value": "98cc391ce59ef8b0e338df130d562291db274632a31f005378b4c51d04b2755a11608f5c390b4ce5b0cf274ebef48dd2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706907519, "uuid": "da6b2b06-84ad-4ad4-a7b4-1fd16b7be7ed", "value": "T189A47C3CB5E794B4D1A2447C0BBBA7B8DB3DFC110ABA17A7938C4B3D4E122854761687", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706907519, "uuid": "5f156407-d490-427b-b646-4911f25053de", "value": "18452b8e1fc49c42c00cc2563b3b7d02", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706907519, "uuid": "489d3a80-4c76-4b20-bd0b-8935b4043277", "value": "6144:MmNkdVKcaxDB5wSQZfAOI95eHiqSev3XjajzcZFp+5EEkyajaciV:MmNwKc8Wf+kB3XjaMZFp8nkyxciV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706907519, "uuid": "8321b226-4dd5-4673-a436-0d07b437b63b", "value": 492928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706907519, "uuid": "da589a25-97bc-44a8-a60b-9fbd05f8cce2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706907519, "uuid": "9636a301-9ae2-4e52-85c4-0b0d36cea42b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "270a3ad8-c160-11ee-b7ea-42010a9c0006", "comment": "Malware payload (DCRat)", "timestamp": 1706832921, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706832921, "uuid": "2841f4c5-cb6a-4268-b9ac-1186049504fc", "comment": "Malware payload (DCRat)", "value": "b08eaa8ab575a6114e666b5c4aaf90f9", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706832921, "uuid": "e6ac85bc-c51c-4244-b03b-1c8acfe010d1", "comment": "Malware payload (DCRat)", "value": "977ed2603aee0d2c7221ad597a19f7dc0e62ec2c76ffa6f1cb5fddac8191dee7", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706832921, "uuid": "48752e75-ed9d-4289-b41f-5d620c561f9a", "comment": "Malware payload (DCRat)", "value": "909be841f72e4938e21d862e62906272fd5ad2cb", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706832921, "uuid": "c5b7086c-b892-4b19-ac0c-a4392b3f84d6", "comment": "Malware payload (DCRat)", "value": "de5522ed4e9678c6074f02786d6998837aa57af791490fab7194324722c6c2098fda3550566462d74330f8c913f47630", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706832921, "uuid": "e30472f2-bb66-4315-b6b4-fe31b4dabebb", "value": "T17DE52342BAC1D6B2DDF71C3A51666A0219BCBE206F29CCA773D4296EDD315C1C7306B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706832921, "uuid": "399de6f5-e625-483c-b47a-dc0595fe81fe", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706832921, "uuid": "b0f244a8-5607-49ce-a1cf-689822930aa1", "value": "49152:IBJoT1Nq4trTIF7yeP2fec+iPiJcsEOaAx1y4t/UQ6EdjhRXOS:yiVtrTC7yeOfec+ikvjaAx1ymbph1v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706832921, "uuid": "562d007a-031c-400d-8198-4342d98866a9", "value": 3070958, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706832921, "uuid": "80c09500-3258-48b5-9e1a-06a6d118f398", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706832921, "uuid": "f6f72e2b-4b36-405d-8e7e-2dd498700c26", "value": "b08eaa8ab575a6114e666b5c4aaf90f9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01827f81-c1df-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706887404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706887404, "uuid": "db4d776f-b32d-4592-be36-be3154bb14e1", "comment": "Malware payload", "value": "889250b21da534b9dffefa9ff9417a23", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706887404, "uuid": "3d37a21d-83e9-4606-b062-3c62bfd9abf5", "comment": "Malware payload", "value": "98035f666034a8c37a68a2441d8b77fae10f7d6d6717826fa33365b189a97609", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706887404, "uuid": "fa8f7d7f-2199-4c7a-bbea-e3c23baad9d0", "comment": "Malware payload", "value": "8589b698a3c728375c1adb3716f00f5d3c9b8115", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706887404, "uuid": "117b6d27-3160-44ad-a2ac-b6790a9b16dd", "comment": "Malware payload", "value": "16598e5dd9c6ea31330cb167603c746624ab9fe39a4e2c06e1955ce3397227b61f68d10ac457bcf3187b274664a79a4a", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706887404, "uuid": "28748abb-db14-48a5-b429-9dbee35eefc3", "value": "T1CD161715FA005199F48A013369ED22D9876038324BE950D7718F5EFADC6FBE0E7B6287", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706887404, "uuid": "244da9e7-d0c6-49fc-b439-30eeee7dab7e", "value": "b827d37392edf5a81b418bfd5c34f6c5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706887404, "uuid": "048a0567-0beb-4b27-bb41-7f8f7e9022e2", "value": "49152:5ihiJcglouhl+f3avja7B3gxap8sF8+M:AhiRoub+PaRxap8sF8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706887404, "uuid": "f25f47c1-be8e-474f-b500-a125ed7cf3ca", "value": 4333056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706887404, "uuid": "d3d34070-7a9b-4cd0-acd6-9e875ecdf37c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706887404, "uuid": "f02e59be-c1d4-4e3c-b3aa-0bc4e1a93b2d", "value": "SecuriteInfo.com.W32.GameHack.Q.gen.Eldorado.6898.8872", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bf96120-c1b6-11ee-b7ea-42010a9c0006", "comment": "Malware payload (GuLoader)", "timestamp": 1706869839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706869839, "uuid": "8f27a3c8-4a3e-48bf-8c80-1f83690a3970", "comment": "Malware payload (GuLoader)", "value": "7ae044cceac98ebed2be611cf9c3eddd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706869839, "uuid": "05fd3b6e-a301-4a09-8658-2fef0d191a39", "comment": "Malware payload (GuLoader)", "value": "98815b88bb0deac6a5a6db0724a43cad3b37ae95776f42afc2926db8d72c9855", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706869839, "uuid": "2c3782e0-f109-4104-97c9-dd756dcd7529", "comment": "Malware payload (GuLoader)", "value": "fd08ea768d9fbc6382c90e2212544f73d59edea2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706869839, "uuid": "2a976f64-f462-4313-b426-82eb9b391fc3", "comment": "Malware payload (GuLoader)", "value": "f888452466525e91159afff900d334e8539007b3ae2ca24faced6f94d0916f9593f39b98a66e4c9827485c575149f42f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706869839, "uuid": "e866624e-a873-4032-a553-d5fb8611a4a6", "value": "T13024F190BAA5846BEC76C732293618275F63FD296870130F27197A687B733C2561FB13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706869839, "uuid": "cf74d54d-2102-40d0-b4c1-8e389549e031", "value": "4ea4df5d94204fc550be1874e1b77ea7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706869839, "uuid": "fd980864-6a58-4f68-b51a-8f1169e80c2f", "value": "6144:owq3NpJeacmyd4QHhbIjcWkY45DsTg62DFK:ozVeacmW1HhbIjcy4Ig6KFK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706869839, "uuid": "0e5847d5-4e15-450e-9efc-f015b13eacdf", "value": 209472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706869839, "uuid": "489ee1b4-9851-45ff-9ee8-f139cc8622fd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706869839, "uuid": "f9cabc35-15a2-40e8-ad69-933b5b7c632e", "value": "SecuriteInfo.com.Gen.Variant.Nemesis.31266.2363.12843", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "151db3ea-c20a-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Vidar)", "timestamp": 1706905905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706905905, "uuid": "de8d844f-e73b-4ff3-ab3f-addce17baa3b", "comment": "Malware payload (Vidar)", "value": "b3db8db328d89d5d301bdabd65901c33", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706905905, "uuid": "67a8f035-a0f5-49f0-a618-07db335f9daa", "comment": "Malware payload (Vidar)", "value": "98bae997d1e2fc6b793a25536f907d66157e741264db635c470ace0311c70b30", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706905905, "uuid": "6fe78394-7b8f-46ff-b089-f26b0e9a5313", "comment": "Malware payload (Vidar)", "value": "f18c01ee928be6ca78968d9e1478c0d5bcd805c9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706905905, "uuid": "d5958a8f-bd99-4eae-81c1-981a057b6b0f", "comment": "Malware payload (Vidar)", "value": "521aac860340ca1acdb7aff969325808f14a8bd915222e785bb0084b948cf007476b112606a5ef27cb404f5c1f353aa4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706905905, "uuid": "8696558d-9797-407d-bcc0-bf0359a6ca30", "value": "T16324CF213AF1C036E6B3497089B492906E3FF8635AB4874F76582B5F7D323C19A66353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706905905, "uuid": "e46f96c5-0726-498b-93c4-fa164c9eb190", "value": "471a0f1afca8daf6a6e12651ef14acd4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706905905, "uuid": "e474cf4c-d128-488c-9bae-643a15c194f9", "value": "3072:ZNxXBLlwPKo3KhXlTtYn7x72GZmcYPupNvTThY/pZNUagUR3M58ZV75:1XBLqyIKhXlJYdtZmtg5ThY/pvUd8ZJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706905905, "uuid": "97a4a3c7-6482-483d-9825-98e9a0ae4cb9", "value": 216064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706905905, "uuid": "3c4afd6d-a41c-4f14-8ef8-03ee4c618276", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706905905, "uuid": "6591bb97-9061-43be-a3fb-c132bc3fd398", "value": "b3db8db328d89d5d301bdabd65901c33.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7131358-c1ad-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1706866314, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706866314, "uuid": "236bf6de-5c66-4c00-89a5-e02a24b5dfef", "comment": "Malware payload (Mirai)", "value": "89ef85f2e32617a840c248a59310f2d3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706866314, "uuid": "aa1b76df-4574-42ef-b5c1-c4fa7fa077ee", "comment": "Malware payload (Mirai)", "value": "98be5889b023e74156e6686a6516fa40f627dedf96efaa4b3825570d77e38cc4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706866314, "uuid": "097fca3c-6b62-457b-a1fc-08cb1a537c0d", "comment": "Malware payload (Mirai)", "value": "8c497b14b3c2ab100e2b4aaca24cc54c0371ba29", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706866314, "uuid": "76e2b127-f074-4b43-921e-900129c9e8a9", "comment": "Malware payload (Mirai)", "value": "46e79e0606e19000b01fb7e26d629444f62387ead66bd4dc925326d18a40378e266aede3e105292aa37cf182c74094ba", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706866314, "uuid": "8f120bc3-246f-4436-87ba-328689841a59", "value": "T1CC336B22A9791E2BC0D0F87A62F78728B2F5070E25A88B4E7D620E4EFF215D0555B1F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706866314, "uuid": "edc3ed36-8624-48ab-8c9d-64d64471c038", "value": "768:M7U+SjoHq9+scN2wNxyxnu3Vt71BuaLYuO+hhQS+F29:0U+Sj2S+scNNxyxnKT712chj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706866314, "uuid": "568c1a6d-ab48-4dd7-a4ab-c767fdb42bf0", "value": 54724, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706866314, "uuid": "b58693c5-6f5a-435c-9efc-b4e448c2d68d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706866314, "uuid": "4dea4927-32db-4da8-938c-c6b68b306169", "value": "89ef85f2e32617a840c248a59310f2d3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e266f91f-c1ad-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1706866306, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706866306, "uuid": "003aad97-1f10-4fc8-b1e0-aec52b1d2917", "comment": "Malware payload (Mirai)", "value": "bb65f03a27ea04bbfee5ebaa7f8dc5b2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706866306, "uuid": "e84b3e37-987f-4ef9-836a-1e037b691540", "comment": "Malware payload (Mirai)", "value": "9a8d981980c3921730f0a551f6ca69804891c9a44e472c44a3524f81c48c6cd5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706866306, "uuid": "a7dd4e6a-0b63-42c7-8011-1b7bc55a5286", "comment": "Malware payload (Mirai)", "value": "3070fe5c9668807f73310357fb99144aa6e3a0c4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706866306, "uuid": "ce5f1864-cd47-492a-b060-978c4cf7ffc9", "comment": "Malware payload (Mirai)", "value": "54bf83aa09a739149006c6c2990c6dcb007fbeb648f30d3a1e1d1d7ac7272c650287330696f245c2d82a444b5480bba0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706866306, "uuid": "bfb5d7c0-40fc-491f-9545-90a6fe7c4852", "value": "T1AC435A0272280A47E1565FF4393F27E083FEE99021F4F689660FDA468275F73158AF99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706866306, "uuid": "b08c5cf4-2afd-4c7e-b88f-98ab2b6d5e32", "value": "768:MsfizT3u6bC62F13cw0yNRn8py3ubepKrxjqL5eYCuoAAa/w3jv3QgmtZAIs4sJA:M0u37bUJcw0qZ3+tOeYTdbo3jHijsHJM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706866306, "uuid": "cefb3cbd-94a7-4b1b-90f9-a77c8b97225e", "value": 58284, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706866306, "uuid": "6754b18a-45ca-442d-b8a8-826c4e90f771", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706866306, "uuid": "83521c83-39d9-4f2e-a577-d65bb0996efd", "value": "bb65f03a27ea04bbfee5ebaa7f8dc5b2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ef931d6-c1bf-11ee-b7ea-42010a9c0006", "comment": "Malware payload (GuLoader)", "timestamp": 1706873843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706873843, "uuid": "76ebd4aa-36bc-4f54-bb55-d33faf21b482", "comment": "Malware payload (GuLoader)", "value": "91230c22f787907b58355e892600cb4e", "object_relation": "md5", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706873843, "uuid": "8a02bbc0-fe39-4e96-8c24-b79e27f21671", "comment": "Malware payload (GuLoader)", "value": "9c679b43688cb797107d5def7e328b2d6dd610d64460c1d3b7021b682546ee69", "object_relation": "sha256", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706873843, "uuid": "301da7a3-cf8d-44c6-87be-107259a7e323", "comment": "Malware payload (GuLoader)", "value": "4edab7ba7f48e1dc392a2378fbbff4c64a7888a5", "object_relation": "sha1", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706873843, "uuid": "ebc4093d-4279-4c21-951f-262afaeccac7", "comment": "Malware payload (GuLoader)", "value": "a9a48d85754af69e38026060bb447b3c46b427b88843079bab9d44799999a1d4832ca587f943370844414084d1cbef4f", "object_relation": "sha3-384", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706873843, "uuid": "d3cc1ff7-9db6-42f4-b3ba-02da3d48b86b", "value": "T1FAB14BB5923615FB9539947F78869D3100341D3222BE865E2D9763CDF80E4E49E2C68B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706873843, "uuid": "f517e722-81b8-49e1-a771-f04509e99b73", "value": "96:F68HbogHln10ZDvnRgIiS9IVWeejKEq+adhXf+dgtDJn1x8:oWbok0lgG9IVWUmg1f+mlJn16", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706873843, "uuid": "1603e02f-be09-46cf-90cc-e56fce6d04d5", "value": 5457, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706873843, "uuid": "4b3e9516-da7c-48d7-8de1-be811537c0e6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706873843, "uuid": "82114993-491e-42e2-b553-8361ea20db1b", "value": "screen_image.cmd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d14ba33-c1bf-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1706873840, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706873840, "uuid": "4e9c7db1-6c62-4d28-968a-23153389566e", "comment": "Malware payload (Formbook)", "value": "6022e4f816a6e1e3002d1981c26b3792", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706873840, "uuid": "41c4dfea-640c-4c36-badb-361b9ab64a95", "comment": "Malware payload (Formbook)", "value": "9cca0efc75bc5ec884145d04e3b37f3eea4983422cc0c98ecb64c5c59aa8dd5f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706873840, "uuid": "69b4d145-c40f-4944-8f73-cd753b0afd8a", "comment": "Malware payload (Formbook)", "value": "6c592baf811ef486039414a60663b72f2619bbb1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706873840, "uuid": "151a1cbf-16c8-4a8f-981a-38d4fa72f81e", "comment": "Malware payload (Formbook)", "value": "5586efc528f2c39e49ba3c2c5734ed532d870cde07942693ffea864758953fc9e1c9fc7d34063e5d68cd36d916221fc0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706873840, "uuid": "148142ad-9174-41d5-949b-8ae83bba9dce", "value": "T19025DF852AB48F14F53E67F450760100E3B1795B786FEB4D8EC0A0FA1EB6B414E86B5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706873840, "uuid": "32dfb441-e6e5-4073-8953-04d44e4cbe43", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706873840, "uuid": "57c40d8b-e0ba-4b84-868b-344762770e3a", "value": "24576:bMyUR0rDcSbDWRZYm+xmeu6n4qkjpT4aPUEIGfH:FDl0ZYmEOT44z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706873840, "uuid": "95e804fd-0df8-44bc-a1a6-5a37b7ae5111", "value": 1030144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706873840, "uuid": "a8901279-48c8-468c-9ca7-95bd89ade17d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706873840, "uuid": "53e076b8-7bdf-4678-b5fa-9cceaa590dd5", "value": "INVOICE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf6dc415-c209-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RiseProStealer)", "timestamp": 1706905788, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706905788, "uuid": "7216707e-9e1f-4777-8573-d36fede78ad2", "comment": "Malware payload (RiseProStealer)", "value": "d17fb27e92939b026b4320f741429cb5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706905788, "uuid": "b36d83d6-3177-45e7-978a-149b89e5c138", "comment": "Malware payload (RiseProStealer)", "value": "9d12457378d6e1429b48c215965868b1721584a0468e9cdfe6c796eb1989b4ec", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706905788, "uuid": "f88fd7eb-ab4f-4136-b389-3bfacf17f552", "comment": "Malware payload (RiseProStealer)", "value": "704a278e894f72b43656b4b0ba96fa07d9d7f1bb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706905788, "uuid": "a71a7be0-3715-480c-a1cd-b7c664d3c3e8", "comment": "Malware payload (RiseProStealer)", "value": "a74bcb3e304dbf7d3e648c3acc33c328cb70427438a8af3b8f90194ccc75b13bdca9bc5557964b9e83a5e6c979e806e4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706905788, "uuid": "51a7ddd5-f830-4713-b496-b52325a90d23", "value": "T19EB533E69FB09E8FD14B4BF69126374205777CEB821251BA9B24FE55DBBE1304A42C80", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706905788, "uuid": "6e4a1d5c-c441-4c67-9008-e386adb3b5c6", "value": "baa93d47220682c04d92f7797d9224ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706905788, "uuid": "cb0bd0fa-443a-4e9a-bbfb-745549a2c46c", "value": "49152:XQy3jZHFmQT5Cu1mRmNa7MM9TG0aCaSlIMV4LSwPnpp:X3zZlrT5C1g4n9T6S3iSwz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706905788, "uuid": "ca661926-17e4-4819-aea2-3e70e25cd086", "value": 2360832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706905788, "uuid": "0bb824d2-71a2-4228-960d-4f47eb6639b1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706905788, "uuid": "b9b0b4b3-d1fc-4048-ba10-d5322ba7281e", "value": "SecuriteInfo.com.Win32.TrojanX-gen.6275.15915", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fff8d85-c1b4-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1706869094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706869094, "uuid": "6f1e2ff2-66d8-45c6-bc14-de0548c27efe", "comment": "Malware payload (AgentTesla)", "value": "85032a7cfe0cbc43986c00caf0b986b1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706869094, "uuid": "d16aba95-64fd-445a-a4f7-7788b56a41e2", "comment": "Malware payload (AgentTesla)", "value": "9d6f96bb83918a989bf793192339ecc548b49fa5780c7adcbf6fb9409bda6575", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706869094, "uuid": "876a7135-51c2-45e8-b18c-57a130463c1e", "comment": "Malware payload (AgentTesla)", "value": "361a0c9e899ab62dac27c296b40a53bc94399dfa", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706869094, "uuid": "2001f801-623c-480d-a9e1-3d48a1dfc532", "comment": "Malware payload (AgentTesla)", "value": "9968b861276000de2e23c75fe65f6b1e89a3f0747a94083d91019dbe2661e856f6dedcc5f08493304473ac21c9a32335", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706869094, "uuid": "6e8c17c4-79e0-4902-8b96-7f56863b4570", "value": "T12063822DD34B02598F520377AB1B1E5042BDBA7EF39552B1306C537933EAC39A1262BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706869094, "uuid": "3742532a-fec6-463c-8ac3-f037e26b822a", "value": "1536:3wAlRkwAlRkwAlRHeDzTxuX5bJyZXi1Ag6zQR:3wAlawAlawAlJ+0X5FyZy1J6zQR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706869094, "uuid": "fd18487a-ba0f-4150-98ce-a8f3ce36486e", "value": 71170, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706869094, "uuid": "a7c9af65-4443-4dac-878a-e045c27104fa", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706869094, "uuid": "19148825-fab9-413a-ba6e-9c84dad8931f", "value": "NUEVA PO AC71189.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "451ec98e-c1dc-11ee-b7ea-42010a9c0006", "comment": "Malware payload (IRATA)", "timestamp": 1706886229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706886229, "uuid": "1fb9ac87-47e0-4241-843d-7b070d1c5b61", "comment": "Malware payload (IRATA)", "value": "1a453325a968647eb750509472c3d289", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706886229, "uuid": "a7fa0189-50ee-419d-b2fb-20fcfa48e75e", "comment": "Malware payload (IRATA)", "value": "9e99996e695592b95f96d6d0323037503dd0a3b1f06823a8fea8596c0da9b081", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706886229, "uuid": "2fe317cd-58b1-476e-93ed-f8ac110a7c9d", "comment": "Malware payload (IRATA)", "value": "436969ded5b176290bc5baa5d0fd64e3eb99ba36", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706886229, "uuid": "4825337d-627d-4527-9bcf-722711754d4e", "comment": "Malware payload (IRATA)", "value": "af6a1dc5327acef7a977d2830831fc107c58708c5dcc0b3359e06bf0944c0e9d096c424e2dd2747e9f8ed42df8aab228", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706886229, "uuid": "d97397d7-68f2-461b-b51d-855e576fc7af", "value": "T1E0D523A3F266E92BC972C1322545133A259B8E19C901F75A795833ED34FBEEC8B417C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706886229, "uuid": "d8dbf99b-7423-41a6-bcd6-7fbaf31c5aeb", "value": "49152:eaV20xhSnavTd+IddiFj/C8F7z8wUUOqORCuLj9NNgcVjMQmVnvBqmNEAqpJPPi:eaV2ChppJdiYyfy51RRlNuc4VnZqyzqq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706886229, "uuid": "313e9b91-bc1e-4006-b204-124361237cc7", "value": 2826370, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706886229, "uuid": "2ed094f8-8bfb-4375-a507-a34d4a17565e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706886229, "uuid": "92066d7f-adf6-4571-aca4-f7b7e9ecaeae", "value": "base.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd0302bc-c1de-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706887396, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706887396, "uuid": "85d9837e-7ac6-4e69-868d-8caf877d56ea", "comment": "Malware payload", "value": "9aae1df0a3874e406242b7f59879415a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706887396, "uuid": "9fe8dcd0-1f54-4f60-b7e5-36f97f53df77", "comment": "Malware payload", "value": "9faa818524e2118e240080b8f3070c33dd04c75aa0cd8f49187a8cfd85f3e605", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706887396, "uuid": "df195b7b-91ff-4fb0-a2b2-ae6be10c3623", "comment": "Malware payload", "value": "f041eceab6f667834f532440d45c630a9224c424", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706887396, "uuid": "6be852d6-220d-41cb-8d0e-8c34cf3ccdbc", "comment": "Malware payload", "value": "da18dd0340c58f209b06a8ac809175705dadbe13975012db9039ca7d73f81c7e5ff92efa92e75970bc1821153acb9271", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706887396, "uuid": "b21ca995-9bcb-4faf-95e3-c8ce4fd4101b", "value": "T188C37D64FFB36239C235437D44357E7203263B1564D7317AA8088E64DC772826BBB2BA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706887396, "uuid": "3a36eff9-f8af-4a77-a4cf-f0cbd908545b", "value": "1536:HuBqbj7sWtu2q28VrzM/0jHYCmjIIT6/qBruUChdH4/QIQLe:HuBqbDtYJM8jHYLB4Lx2/rk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706887396, "uuid": "98beae41-4feb-4d0c-927a-ac73a7caea67", "value": 126976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706887396, "uuid": "9a78740a-10e6-4ea6-8b4d-eb4e1b67e486", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706887396, "uuid": "84ac58e5-bb72-409e-8029-591c1ba71d7b", "value": "SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.27274.789", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44a0affe-c164-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1706834688, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706834688, "uuid": "0ff03095-c6d4-49a4-a48b-7a4562bac50a", "comment": "Malware payload (Mirai)", "value": "065ab3e5788675bd94be22d4920166c0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706834688, "uuid": "b16825f6-2114-4b53-bd45-743a8698868f", "comment": "Malware payload (Mirai)", "value": "a060d60d13e0bc5583c7fe3bb35cd2d74bc73fe3fbd9a55868b7fdd277c092bf", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706834688, "uuid": "adb74d0e-f0a6-489e-a720-71086df231be", "comment": "Malware payload (Mirai)", "value": "f0f2fcc69bbb4af972ac44bcf1f01a3d83071f6b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706834688, "uuid": "645c494f-1e0f-4862-ae79-5d32d2e9cee4", "comment": "Malware payload (Mirai)", "value": "cb5ed048fc928dde5e8ea87d184cc90ec1d7c01590b785290896a1866c38372349c73a7117bb816dc2580c35c8399685", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706834688, "uuid": "df05ceb5-4e15-4e03-83e7-2a153ea9a2fd", "value": "T167D34B46FA418A13C4D513BABAAF41493332D7A4D3DB730699185FB43FC67AE0E63606", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706834688, "uuid": "2d556c83-5d0b-4af9-b48e-b29237ee45f9", "value": "3072:5KacBqVuJVkW1cIOPZoxNOqMP0wctzHnaPF+84/M/92L18Yj:kacBQuJVkW1cIOaxNOqMPVo0F+8MM/9S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706834688, "uuid": "90f712d1-8cb7-4a07-9675-fbba6496f3ef", "value": 136482, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706834688, "uuid": "bd08eadf-24e0-42a1-b942-7e79ffcb4fc6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706834688, "uuid": "90747231-dd98-4494-8b25-73329543a248", "value": "065ab3e5788675bd94be22d4920166c0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45aacf87-c1f0-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706894820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706894820, "uuid": "a4544774-614e-4663-bd92-e567d16872c8", "comment": "Malware payload", "value": "078137cfd2801c9951fa502c4bfb0b52", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706894820, "uuid": "bc2fcacf-5079-43c1-b860-1f819cb0d5cd", "comment": "Malware payload", "value": "a5a6c935c12a7ae2180647a4a521ba565f380fe89441f831a5dc0f45b037e83b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706894820, "uuid": "301fda4e-bf23-402b-a6d2-e1c0da442205", "comment": "Malware payload", "value": "e89d42c2ba431e4ccb83925b5baffc70cd858590", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706894820, "uuid": "77b2bb3e-9c25-48cb-bfde-8cda1b6e59b3", "comment": "Malware payload", "value": "af058e5a8b79712d80211ee68936a20d8e6ffdb2fd5e04e49d724b2d6bcc8ea1c60191c8a17fc2fd171c197d59437ee6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706894820, "uuid": "8f77f432-ddb1-4d25-a0e4-f75ff0326a45", "value": "T13AD5D93CECAC007AE025F47ACBD9AC23D77FB062A56214F605438B63AE4E356D531E95", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706894820, "uuid": "46166490-4cb3-4c5d-8d66-2a4de71fe7e2", "value": "ecc51492b9a27d5c694af6ca9db4f917", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706894820, "uuid": "0628f17d-1b46-48a7-8bfe-4a6d8fd40368", "value": "49152:2+EZh20Sbg3TyOXP8ZIHPujACspE16s7jJ7I:ql3TfPsACsA7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706894820, "uuid": "0d55c24b-ed9a-412d-86d5-28f8dff45660", "value": 2967040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706894820, "uuid": "405a1d89-3cfb-407f-acf8-e131efb48af9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706894820, "uuid": "a39f7d6f-11ca-4c47-a6cb-1f1aa5452b4e", "value": "SecuriteInfo.com.Malicious_Behavior.SB.29876.449", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe499b9a-c1de-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706887398, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706887398, "uuid": "cbc93e58-e562-46e5-b79e-ecca53cb9018", "comment": "Malware payload", "value": "061aa40f06efd8daf4f6aebf95301d1e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706887398, "uuid": "c579d7a4-43e3-43c7-93b7-43aef2d13580", "comment": "Malware payload", "value": "a5c52dcd4514c2c3aad4f6dbf8c6dfadedca102dfac0d06a77491b857511116e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706887398, "uuid": "a04e03cc-3548-4d78-bb2c-dbe4b07396f8", "comment": "Malware payload", "value": "68b6117a2a10420121aaf99eca5391744574d057", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706887398, "uuid": "2915ca41-13b3-4c8a-a1dc-9e6a31d46485", "comment": "Malware payload", "value": "3a6e30988ecaa76ac722bea3e683307378f0e078b88a3fafdc97c99a612f411a7048fd07c80fb842fc5f6853bff01895", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706887398, "uuid": "ddcafcc7-4ddd-4b68-83b8-231e570d3b62", "value": "T164A3A3166FB0D12BFC7326B006177EBD5663E912A32B4B33A658F9FDCB614854F00286", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706887398, "uuid": "082b558f-045c-4d9b-affe-4c88938ad32e", "value": "768:VKSBqh4pIAo03HzRuwiqTkFTBL2jxPevDB/JL:VNBqb83TRGSkFTcADB/Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706887398, "uuid": "83bd52fd-5644-4c66-b16c-5b8730a30c42", "value": 98304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706887398, "uuid": "e95137ca-12ca-4b34-903f-6a7587843b5d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706887398, "uuid": "22478797-3d98-474e-8a99-45865569a266", "value": "SecuriteInfo.com.Win32.CrypterX-gen.26621.23508", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba3ebf12-c1b3-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706868816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706868816, "uuid": "aae138ce-c755-42e1-8331-c89a9fa187be", "comment": "Malware payload", "value": "5460b1a336dd37e51cb7c261171ed0d9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706868816, "uuid": "d932bd78-6608-4248-804b-1e8399b1b177", "comment": "Malware payload", "value": "a65274b4141f0610c78d39adce763641f09172db07a3814940fa75befcee5197", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706868816, "uuid": "919c2cb0-b6ea-4df9-982d-de753de0a205", "comment": "Malware payload", "value": "c32290a93a491e81e40e7bc8d50fdd61eeeb4590", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706868816, "uuid": "3955e971-864d-4dbd-84d2-d9d2ad21f46d", "comment": "Malware payload", "value": "6f946a1447f4e6a4693edcdae0efb5a9a4646a510c0a68fdeb6075aacdab5ccde1ade56701bace0ed4bc4a945ddde316", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706868816, "uuid": "ea9dce9e-e171-462b-9f6a-e13412ae3b40", "value": "T15904D706AF510FBBD86BDD7702F90B1128CCB81716A53B753178E924F60A58B4AE3C78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706868816, "uuid": "157b0e18-0fde-4fe2-99fc-2e2470317b49", "value": "1536:Rj3vhduzVVpWy05jWqvtJLBMjg7KDCHeVa6sldrZynJ0ZSPeybN6kd1Vq+sPuyJj:V3/KV/WQmtMaHDknyoIkdHtsmMj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706868816, "uuid": "74382a6e-641e-457c-827d-e1aab7e0ab32", "value": 180644, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706868816, "uuid": "5f9fe48f-2837-48e9-bd76-527fe2b1f973", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706868816, "uuid": "f691b8e5-3b17-4bc5-a604-b03d35db5ae0", "value": "5460b1a336dd37e51cb7c261171ed0d9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ec377b9-c18c-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1706852019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706852019, "uuid": "80055d9e-0d18-4b28-978f-9f060c5252ca", "comment": "Malware payload (Mirai)", "value": "8cf85d94aa4c5ed1a75c1dac82446b7e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706852019, "uuid": "598ef7f4-00a5-4250-9eae-99a50a0ddd71", "comment": "Malware payload (Mirai)", "value": "a72a484bb8f3f78ea50646b30ab40596bdc97256f490aff4df0d200b893625d9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706852019, "uuid": "d28f9f11-b3e7-43e8-8402-e513b633f5fa", "comment": "Malware payload (Mirai)", "value": "a3b64e50160c14169992529a29ffbbe944b477e7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706852019, "uuid": "aa69f572-c699-40f3-894a-28dbdfe1a022", "comment": "Malware payload (Mirai)", "value": "2e69941bf82783d782a87f2638d6c64f15f3ccea0b1dc488f012d8faa45042f2018963d469b9423ca57c6cb1751eddf9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706852019, "uuid": "354b5e4f-5be6-4be7-8b7c-0327d8a6a2c2", "value": "T18FD36A76CC266F69C295D1B0B0348F7D1B53A69082475FBE66B6C2B54043CCEF6067B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706852019, "uuid": "da1a9443-a505-4576-acd0-90665b0e369a", "value": "1536:OaYC7LGPGAcBGm0NAwsN4/nldKhpCf9KEiY3vaJhg395GBWsYPYq8HhOka+YY:OQyPC0jj/KhpYkECJhIiBWfPYfhJa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706852019, "uuid": "b6d0576d-b3d0-43d3-a974-58d3a198cef1", "value": 134112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706852019, "uuid": "646933c6-e7ff-4c46-b2c7-2232a3f906a0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706852019, "uuid": "97115a26-a15a-4714-bca6-cb7a9daf5270", "value": "8cf85d94aa4c5ed1a75c1dac82446b7e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ddb3614-c1b4-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706869037, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706869037, "uuid": "99c250f9-4d1d-4a67-927b-402cd38ff80f", "comment": "Malware payload", "value": "1cdf8cedd29b81b611e4dd2bbf3b5e08", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706869037, "uuid": "dcd98415-1e07-4d43-a365-1430a4caabcc", "comment": "Malware payload", "value": "abd4dcb78a92e4f98b88199ce08f88a3ce99032390747de6f3222f8d4a71939d", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706869037, "uuid": "a0830d2f-02c6-4fec-b241-2ee85595bf59", "comment": "Malware payload", "value": "79ae856226052b05ec389b2db7cdfd429418f760", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706869037, "uuid": "10b0a453-f88c-4a63-8be1-e18f08d988df", "comment": "Malware payload", "value": "7db3b52487669dceb549316ef6bcec9b6511849272709cc86ed129798729e3f203ab4d5f1c1060b2d41ba456955a5b05", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706869037, "uuid": "bfaff825-3bfb-42f6-82dd-757f2453d423", "value": "T1B6948CD930C2B270DA65EB794335FDA5531BA35B15309C2EB03D03E00BA9BE9DA1958F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706869037, "uuid": "13a86b6e-81f1-4fcc-b060-8ea03e02e446", "value": "6144:LanfOsXsSiRVKva4ygDTeCcnsEJWGd93nLYDG3djdsP/zQ/4rHTFKBS9TP0ey:La9XWVtg27nZZndzs3z5HT90R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706869037, "uuid": "1d9aa858-c145-4d90-9437-50a9dd70f888", "value": 423781, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706869037, "uuid": "32effe80-4b42-441c-b937-6c4407ac7a92", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706869037, "uuid": "fe2fbed7-6686-494c-9260-e3a07724cbe6", "value": "Document.pdf.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e94eaf1b-c1f0-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Heodo)", "timestamp": 1706895094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706895094, "uuid": "e1c6a2da-6d69-410f-9aa2-b313330c2118", "comment": "Malware payload (Heodo)", "value": "2562895965e8f788293790145a69bdd3", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706895094, "uuid": "4066f006-28c9-4f98-a3f0-5d2479d96eb5", "comment": "Malware payload (Heodo)", "value": "ac02aee660d44a8bfbc69e9c46cf402fd41e99915e13d0de3977e662ef13b2ca", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706895094, "uuid": "ca03773a-31d7-467a-b4f1-385bb226334f", "comment": "Malware payload (Heodo)", "value": "9aec636dbd172f325923b240a5533de6a5038f4f", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706895094, "uuid": "60f137e2-8607-41f2-b4c6-d3ec114e7242", "comment": "Malware payload (Heodo)", "value": "0a12b8e4f888d827275470d196d5655231452db8c87ec44d3f76aeb20db6d616248ac68441fccc52617eb0180315f02e", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706895094, "uuid": "220b630d-3a07-4171-ba8a-8bd30bb8b7cd", "value": "T178546B0AB3A405FDE8A7D17CCE924502E672785A0371DBDF17A046163F676E0AE3EB11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706895094, "uuid": "edb0572e-93e6-4c4c-b1b7-d6c904fd33f3", "value": "b7c29b00f762ebe7f8dd55697c3345f9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706895094, "uuid": "5e0a4c57-12fe-4d8c-a62f-2b3f989fa969", "value": "6144:kYT5kjA6A1e7Vbl4ESdOFoUC/aikQLOdkaqy:vT+DiehbqVOFq9Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706895094, "uuid": "ddb917e6-fc7d-4e4e-8630-b018400690e7", "value": 299008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706895094, "uuid": "e1d2405b-6258-4df3-b8f1-ddd95c09e41f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706895094, "uuid": "3977b1c8-2abc-49e5-b187-a193f6dd22c1", "value": "out.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33278c03-c18b-11ee-b7ea-42010a9c0006", "comment": "Malware payload (GuLoader)", "timestamp": 1706851409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706851409, "uuid": "ce6807a9-6f21-485a-b8f7-1a08d4281265", "comment": "Malware payload (GuLoader)", "value": "6d8d44e78e4bbde9df1fa7f0a91ba489", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706851409, "uuid": "b176cd82-d00b-494a-8ab0-0e8bdfcc7931", "comment": "Malware payload (GuLoader)", "value": "ac3abd8f72a38f8d17232834c1cf3e79f1d2f8963bd9bd643c5f1bed4623c886", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706851409, "uuid": "59da4e5f-19e0-476b-b343-39806f3c74a5", "comment": "Malware payload (GuLoader)", "value": "3a451451cd04a081fe9383cb6cee525207554cf4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706851409, "uuid": "4f975df2-5ccb-4d70-844d-c5d2aabdb6a0", "comment": "Malware payload (GuLoader)", "value": "c799ecf02dd52c35a46183d035224896cb0b84c7187e779e3762a8800a622586a559b5237b1cb4374371eb6acf37d1bb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706851409, "uuid": "0e9f3399-aa13-4e05-8ea7-36a2a664dee9", "value": "T1E3E423DC52A4C052EA235674C8BE46F9BAB5DD21E348D64327A0BF5F3E31446EB1A703", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706851409, "uuid": "4d409328-cd0b-46ec-8f14-f839e8ae190e", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706851409, "uuid": "cb9eecc3-40bd-4988-8ebf-eb323014ca0b", "value": "12288:wYtmv8+FmLv/8QrX7oNRk6eFd5uzbCfqHUxUyHZUx0iRAuD9nIyAL:wYtmv477rX0kh5unM6UpUxZ9nIyAL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706851409, "uuid": "079020b1-d708-4023-b404-a3d88d687bb3", "value": 679456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706851409, "uuid": "42856066-7c9f-4aff-8638-6ef681b46413", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706851409, "uuid": "e8f3c120-d0f5-43cb-956e-c0755c2d6f08", "value": "SecuriteInfo.com.FileRepMalware.16866.25842", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "867ccbf1-c1dc-11ee-b7ea-42010a9c0006", "comment": "Malware payload (IRATA)", "timestamp": 1706886338, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706886338, "uuid": "8aec067b-323e-4322-a36f-26ecc7f3f223", "comment": "Malware payload (IRATA)", "value": "c158566ef780149392e380d26b67950f", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706886338, "uuid": "d43f321e-3922-4add-9c0c-a670ae4c6747", "comment": "Malware payload (IRATA)", "value": "adbd1a4a2f154265ba344d77634eab720a2e9ea52335b3b43cd02554d4f739c9", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706886338, "uuid": "167869a1-70da-48c6-a678-a575fc6bc923", "comment": "Malware payload (IRATA)", "value": "dfb5cd237bcda08f4d74c5e686550cdb0d5fc37d", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706886338, "uuid": "27b83aff-d88b-4264-a429-3a38cfda102f", "comment": "Malware payload (IRATA)", "value": "7641580a47dc7e4dd191215cb98b4f84fdf0833336197c1677858681a35adee057f3748ad67674140432ec548876b8e6", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706886338, "uuid": "894dbb52-b52e-470a-9a6b-c2885987128d", "value": "T118D52353F376A857C9F6C37221B45B35143B0D689B47A74B254873BA28FB9EC0B812D1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706886338, "uuid": "b18ba93f-7151-4923-8127-5d7d5ede657c", "value": "49152:T/T6Zus+oZggBv4iGp7Utc4y3Lljj8SQgx+k/OGqfjWy52kqbRHp:7mkAggBv4rpMqLlcMHOGqfjWy4bRJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706886338, "uuid": "f5103ae9-86f8-4177-afc9-147dab7f9aba", "value": 2818178, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706886338, "uuid": "14ea2b71-da44-441e-9094-ab13edc85682", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706886338, "uuid": "373ff6e9-64cf-4b28-b4b8-2d35f4705034", "value": "app.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef75d237-c1bd-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706873200, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706873200, "uuid": "90eded65-de0b-454d-93db-cf85413551bf", "comment": "Malware payload", "value": "af2ec83c03d7f43eb2ec8239e53e28b7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706873200, "uuid": "df026690-5cfb-4365-bd65-ac831f785c4a", "comment": "Malware payload", "value": "af4c2dff233c3dc93d4122dc190ad381a776279aa83e0280d6f4754e5a6c08cc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706873200, "uuid": "cc89beec-427c-4541-bbd3-fcd7428bea6c", "comment": "Malware payload", "value": "74c8a54cc84a3ff8840bc8f596109827a6cd4fb2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706873200, "uuid": "76f0d541-27ac-4bfd-86a1-17dc5cc6425f", "comment": "Malware payload", "value": "d04175ba0e26c83fb3c8507d6c8317b42af8ac5f29ad5bc8221f1e25226a2585d0d6c2f5f9d63563e436a9385d820bb5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706873200, "uuid": "11ddf026-5791-4c5e-83fa-ffd480099c27", "value": "T188B633F02B5406E1E8EA493EC417C859EAB4F8052354EEDF4324869A1F2BB4D1D7FB91", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706873200, "uuid": "24ff00b4-ddef-4e8d-9693-315112eed6f1", "value": "1af6c885af093afc55142c2f1761dbe8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706873200, "uuid": "bf01f3ce-53f3-475d-87d5-1ac6f6ec06b1", "value": "196608:774fr1Pw2Ixkf6FePsdLptuZeNLHFJMIDJ+gsAGKkRVKGyT:n48csdLKKrFqy+gs1Vs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706873200, "uuid": "8bf635b0-f328-4c16-ad5d-9cae4c99f4b6", "value": 10656473, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706873200, "uuid": "78f753d4-ab2b-4013-a8d8-dff1fcff6d73", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706873200, "uuid": "63147d3c-14d8-4651-834f-b6be97e9507e", "value": "SecuriteInfo.com.Win64.Evo-gen.32657.27121", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08b21c85-c196-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Stealc)", "timestamp": 1706856063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706856063, "uuid": "0c6e45d5-387d-42f2-879e-e95fbeb8db19", "comment": "Malware payload (Stealc)", "value": "ed58db27119bd185889c20c9a51f965e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706856063, "uuid": "5d329127-8ed7-4ae5-9ae9-b469062cefd4", "comment": "Malware payload (Stealc)", "value": "af93512692780e607f7f46ba4ec615e13d6e12f541a50017b724eb1c887ceaf2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706856063, "uuid": "238cbf9e-8ba1-40ee-8507-6b6c556f2517", "comment": "Malware payload (Stealc)", "value": "a683cb7dd7246fb401200816ed1bcf9894f770dd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706856063, "uuid": "646fb07f-a79e-4ea9-9d57-f9517859b7fd", "comment": "Malware payload (Stealc)", "value": "0c84bac88f9d6ebdb6e2394787c1f126103faa88f14ebc842b6d041bdc21d43e7bdca88ad2519b2814d86a342a88b813", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706856063, "uuid": "50c02c61-6497-407a-aee1-9c70730398e1", "value": "T1D2A5334DB5578E32E8B94972A5312BFB67BE8E7845D435187734B7C8387002B229FB42", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706856063, "uuid": "e480e26d-ae2a-4a1d-80d6-30527c6422bb", "value": "f4639a0b3116c2cfc71144b88a929cfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706856063, "uuid": "b79af3b4-2951-4c2c-93a0-b7e1b4907e94", "value": "49152:Ch0F2z0X1W34qvuyXPHcqaGqW9gwLgMyu5noEiyIJAuq:CeFdFWINS/NF9gpMR5oEfn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706856063, "uuid": "2e40b69f-291a-46a8-a65b-b9737d61440d", "value": 2123221, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706856063, "uuid": "c04af131-20b7-4e23-a9fc-d4cfb076bd3b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706856063, "uuid": "50c51fac-4245-458e-9b86-6848c720f10e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96286b45-c21b-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706913423, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706913423, "uuid": "9677731d-033a-4661-b368-5346f597be9c", "comment": "Malware payload", "value": "0d710c6fdfc8e172c737df123fffb5de", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706913423, "uuid": "bec63261-9080-4213-a74f-5f75f626aaad", "comment": "Malware payload", "value": "b0168f28a92bcbde057c5a3218a0ef36f51f91f96308b9abf526e025e5fa26a0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706913423, "uuid": "5d660c5d-6e77-48d3-ac95-6f286c55d5db", "comment": "Malware payload", "value": "e95f7fb206c1fffef0d8154477575f77f1d21d8a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706913423, "uuid": "b8adda97-6642-493c-9dc2-dc70dbe9a9ec", "comment": "Malware payload", "value": "61dfde9b55bc0ac1ce1c964b74e236f828bddee7db2115e82aaf2e963a5fb980da02fd2902e47ac66c5b30380a0b646e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706913423, "uuid": "41c866af-e367-45cb-ae6b-e9412d704e41", "value": "T1D6B533E52932AF88F5330FB91645D046B8CF7C431885C05E6B09F586D7BE4FA912EC6A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706913423, "uuid": "3e68968e-aae1-4e63-a6de-e5b88a1090e2", "value": "baa93d47220682c04d92f7797d9224ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706913423, "uuid": "e7171b17-394a-4013-8e0c-de834937d315", "value": "49152:/UPdNMhgtD/3hwtUheMEKQFqogrnq+mHQUX4nFXdfwpc00Ld8VhbX:/EdNMher3hwYeMEyprC1mee7d8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706913423, "uuid": "2bca0da0-3859-4e1c-8e0c-c2ded225e283", "value": 2291200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706913423, "uuid": "e3092ca8-42b6-429d-8555-b6b46708ffbe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706913423, "uuid": "0c025a11-659c-4a95-9529-227aaa6cdad3", "value": "SecuriteInfo.com.Win32.TrojanX-gen.1960.11858", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e18b4a24-c1f5-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RiseProStealer)", "timestamp": 1706897229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706897229, "uuid": "bdc591a7-414c-40b6-9f6f-741fc3ca0db6", "comment": "Malware payload (RiseProStealer)", "value": "d71fc13d110fb0a80a174c8f22d12061", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706897229, "uuid": "772dc5f1-c926-46a4-a2dc-4330519edf58", "comment": "Malware payload (RiseProStealer)", "value": "b1be593f6f3d015a6261826b26d2baba7c5f3c86507509ac6d261357d5920113", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706897229, "uuid": "bf667a78-f3e2-45a1-8cc0-4d51a7d5a53b", "comment": "Malware payload (RiseProStealer)", "value": "7aef89a00af1fb3193a13f8d295098687062ad9b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706897229, "uuid": "ce09af39-f0cc-4cf2-9266-e08e882c2a77", "comment": "Malware payload (RiseProStealer)", "value": "1882b41e034179ee224c2cfb0ff579ecf9056f74de46ad12575601698a1f0ac9fb5ec3c4273a61c17cf4502d4448b504", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706897229, "uuid": "7823f838-bb62-483f-a80d-ff7209431e15", "value": "T1D5B533E03633C49EDC9B57B95303F9581393EC2B14E08582186AF8AF0BFD6B156B5E46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706897229, "uuid": "4cb110ed-4127-4da9-8aac-5bb31702e1c1", "value": "baa93d47220682c04d92f7797d9224ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706897229, "uuid": "6b7b3108-e438-4464-846e-a8ee2562aa75", "value": "49152:Qb8hiWpdjiLLmRYlhJ1lOttG8ztQCSa5zHRbqQQC84:QbGtdmjlX72t5BQXmLRuQQCN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706897229, "uuid": "46459e1e-d4b0-4b20-bfc5-1f9506f811b3", "value": 2336768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706897229, "uuid": "af4e2c2d-61d5-4c4b-9333-d614d45a0c8f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706897229, "uuid": "b7518692-63d9-4caa-8e74-d58e31b24fbe", "value": "d71fc13d110fb0a80a174c8f22d12061", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "316f4812-c18b-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1706851406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706851406, "uuid": "972c5164-f5dd-4fc8-8f41-d75ae1c7372f", "comment": "Malware payload (AgentTesla)", "value": "5642664df34f52d47fc8081467ef6269", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706851406, "uuid": "ad4f2d81-ee31-409b-9fbc-9334d8361027", "comment": "Malware payload (AgentTesla)", "value": "b3c4993a8982b5ef99e1c6064b133a317a221d51a15aa53047b05e340b808b62", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706851406, "uuid": "ff92ba0e-5787-4fa8-ba7a-8eed40903c01", "comment": "Malware payload (AgentTesla)", "value": "cc212675b073c75ae349222c2ea2ef7ec210aab2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706851406, "uuid": "a80050a9-892b-41c1-97bf-88e9ab791490", "comment": "Malware payload (AgentTesla)", "value": "4e1f3f3d137f1c9e0df1edb787dfd5fdfbaf2ff88f3af7847196c36bd22f969c2e4304cb64f240adf046df036b08cf16", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706851406, "uuid": "eb83ceed-df62-4477-a51c-1a4182418f9b", "value": "T188E41269FA3964B3CBB814FAA692152903F7556EA063F2C81DCEE0EA45D1BCD08153C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706851406, "uuid": "76d54b3e-4822-4283-bac1-ee12a33831a5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706851406, "uuid": "e54cc866-b19c-4055-a84c-e4725d8651a0", "value": "12288:JvAtoE1MmajvIOLkpB+fUmX6tfJDev3W/7IOx5q4NbcYd53rD226:e2E1CAO4pB+xt34x5qx8rD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706851406, "uuid": "084342b6-8c6d-431e-9975-efa33551e449", "value": 705024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706851406, "uuid": "06f4a583-b672-450b-8c38-7cfb8adc6ec7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706851406, "uuid": "3434f09b-810e-44e0-9cb4-87d779451e52", "value": "SecuriteInfo.com.Trojan.MulDropNET.68.14731.14018", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27e668bf-c20a-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706905936, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706905936, "uuid": "a4226cb6-98f2-4f38-96bb-621fb0198c29", "comment": "Malware payload", "value": "1bdea4150ae8275d2c50f7acb39f5c18", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706905936, "uuid": "17ecb936-07d4-49d3-b5ce-ca6a0e1cc9f8", "comment": "Malware payload", "value": "b4406d29f56193d225b029710411e0ab26e4261bc25ef407734f8c9144265bcb", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706905936, "uuid": "b2177851-4d6c-4265-bcea-e222ec129d2a", "comment": "Malware payload", "value": "3421511589ab5c4be80b78eb1a38015373e4e2bf", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706905936, "uuid": "5fbf18ac-476e-4886-9690-313970bcfeed", "comment": "Malware payload", "value": "e7aaa272d2e1b86a37f5363706f6b011a7704f7d6f18fc35f0c9c880c7ee54390cf6c4aa851cf2f5b33529fae7b5cf49", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706905936, "uuid": "d8b2a887-d7a3-44fc-a0d4-8c3c4f3aa0c0", "value": "T1399339B0FA540B5A2D4B67A5EC42AA41C6FC861506330076FEED734D610E8ECB7BE64D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706905936, "uuid": "bc3ccabe-5ed1-40b4-9a00-08ce643ed38b", "value": "1536:gQuJIMQR0pPxRR2Wk4oC8ZNsC061lXMm+yhHCw+ykc+okI8X:gHJIMQR0pPFVARbSyVz+oUX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706905936, "uuid": "13c33b5e-28cb-4b3d-be40-93cc332807be", "value": 91332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706905936, "uuid": "a7a398f2-e06b-4c95-8ffd-710a2e043379", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706905936, "uuid": "f10944f7-99c7-4db2-89af-e1d9350eee5a", "value": "Arrival Notice.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "488d84d5-c164-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1706834695, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706834695, "uuid": "0f760bc0-5f51-4f59-8e71-11b72d217afa", "comment": "Malware payload (Mirai)", "value": "0ef61f2ae287f5845cd4071d0c05d7cf", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706834695, "uuid": "294a9cee-ebc2-4783-abed-46aeb6535c04", "comment": "Malware payload (Mirai)", "value": "b7136fde93017b0f9b3ec6bed1925aeb649c39d83f18bb893ce001c525aa665d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706834695, "uuid": "bfcbc008-c4ff-46f9-a82d-1a467490e2af", "comment": "Malware payload (Mirai)", "value": "5aa5ddb1f29afd7a68724a60a3abbf4924ee97ac", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706834695, "uuid": "8f2298be-1d97-435a-9600-46b2254bfc32", "comment": "Malware payload (Mirai)", "value": "80d063b111dac103f8da2a6710a92f94c0aca47d925047ec8612be9073fc297ccfb82b3bb18b13455f10961562a82c31", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706834695, "uuid": "2387d5c4-e411-42e5-a7ce-e9cf697a1e21", "value": "T18C731A45B8818A16C5D813FBFD2E018D332667F8E2DF7212DD105F647BCA92B0E67A52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706834695, "uuid": "49a0d25e-e8b3-485b-8c80-f6e8807f7afd", "value": "1536:eNn8UxkW50thqBtIC1R4/LsdH0ZBYSSZvNNSVzfpnDM4ioyuuz60d42+:wxkW0hCtIUOSqzgjMbyuuz60", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706834695, "uuid": "4df12f1a-cd7b-4d18-8ecd-85f8fc2f852b", "value": 75056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706834695, "uuid": "6f0e0cca-37f1-4f6f-a7bc-e79d45260c8d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706834695, "uuid": "17791361-3d87-4f21-9ca8-d31bb9f2a976", "value": "0ef61f2ae287f5845cd4071d0c05d7cf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d19a44cd-c1c7-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1706877445, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706877445, "uuid": "d60e3f8a-271a-4263-ab4c-8f86d29e881e", "comment": "Malware payload (Socks5Systemz)", "value": "f1963893f87714468f02a81752b8d858", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706877445, "uuid": "4166f2b4-5394-4550-916c-81573493a2af", "comment": "Malware payload (Socks5Systemz)", "value": "b71c926b6979fa4fa78e654f61d0dfed4ee2f3d9ca4d539657deb654436e7b71", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706877445, "uuid": "ae14dd6d-5566-4db7-8426-c3fc3b7d600f", "comment": "Malware payload (Socks5Systemz)", "value": "57ea85cc5376bce07ef81b754b0421054eca91c0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706877445, "uuid": "2e0ed0a2-b1ca-455d-8f1b-6aa257f2f507", "comment": "Malware payload (Socks5Systemz)", "value": "3cf495b1ace80bf53b202593b77fca17359b08a731c646b412a7a2ece3ba35bf99b6891a460728ee4bdfed28304455a1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706877445, "uuid": "c8b1c427-72d9-4252-8da1-1fed300a6b43", "value": "T17776331130A368F6E959FF7C6E72462C92313AA35D09448CD2BB7E881F7A544D06E3B9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706877445, "uuid": "e51a1b26-a91f-40e7-bb79-22ef7d1eb6bc", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706877445, "uuid": "ee8dad56-6169-4e49-b1b3-99670e046746", "value": "196608:iReymo0w/KxWAwesAEswsO28u0a9kG33dtXmOj0Nwb0ef:Imo0SKFwHuwsOs0eXXwq0ef", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706877445, "uuid": "527627c8-e107-4014-908c-db917424823e", "value": 7646617, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706877445, "uuid": "88df6951-0eaf-44b4-b9c4-80d6d673ebd1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706877445, "uuid": "77d12d2f-731a-44d8-aa15-0eeb6bc16c01", "value": "f1963893f87714468f02a81752b8d858", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25156e32-c17e-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Gafgyt)", "timestamp": 1706845802, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706845802, "uuid": "37e76972-7ef7-4801-98b3-6ae54e38d355", "comment": "Malware payload (Gafgyt)", "value": "c384b4b8f1d5dcd3c35055210e79436d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706845802, "uuid": "5417f378-878a-45c4-8e45-5817688f28c4", "comment": "Malware payload (Gafgyt)", "value": "b7cb5023c117af4a1cd95cde4134470f766f5c87f7456759572f2e2d5e18049a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706845802, "uuid": "6e884fec-bc8e-403f-95c9-f1d39732f6e9", "comment": "Malware payload (Gafgyt)", "value": "ab57cd5d67cf83504104f7183ce150faec6ecf9b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706845802, "uuid": "df21bd6c-0267-4bce-bd3b-11aabf675c42", "comment": "Malware payload (Gafgyt)", "value": "307e2bf33f6d07e42558e240d3dd06a304d8a6d633c7d742bb1e75be5bfb628ed7550a07b418fae7d700411b13cf8bb2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706845802, "uuid": "036ca99b-2403-4349-b71e-9857c89d6027", "value": "T191D3D617ABA15DBBD80FCE3302E64521109EE49613957B6BB178CB1CF74BA8E09E3D44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706845802, "uuid": "bd4fa749-b2ab-450d-a759-a2be085c156f", "value": "1536:76ejNyUhayRB4pa4ggYJ7vOTld7xhxPYsXm/KBgvYYiCh:74yX4pNL3lhx3mCBgAYiCh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706845802, "uuid": "03973c64-d69a-445f-b61d-545b5c4d177c", "value": 140059, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706845802, "uuid": "08f0fa29-5ad6-4bcb-b13e-ea8a350aea88", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706845802, "uuid": "6cef602e-7386-4130-88ca-ae5a6a37361b", "value": "c384b4b8f1d5dcd3c35055210e79436d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2a3f8d2-c210-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Loki)", "timestamp": 1706908854, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706908854, "uuid": "ea0376aa-e88d-482f-be39-12710a0e4a48", "comment": "Malware payload (Loki)", "value": "1fc7da933276f6269605ed9a727d080e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706908854, "uuid": "5a920c6b-a4b2-499e-b471-d2d1af00f605", "comment": "Malware payload (Loki)", "value": "b96ea81844a66251996075415536c413521d7886d7775df302647f41dc39558b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706908854, "uuid": "a39292f9-1d1b-45ac-8548-341f3cc838fc", "comment": "Malware payload (Loki)", "value": "452f7c160091b0fab9b813f3d60dd11380ab4df2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706908854, "uuid": "46986f1d-9c2a-4631-a703-093c3ccec698", "comment": "Malware payload (Loki)", "value": "5c0ba66fe80f652dbdae0dd0be9eabe91dce6fc9790c43081b696042e4d1b9eddf13d5957321dccdaeac15f61e8cff1e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706908854, "uuid": "8f30083f-9c97-4654-8ff3-c948001a9838", "value": "T13D64CF5AED7ED2DCCC7792B0202247A52529B17EC92F475EC50EF34B09AF30978216A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706908854, "uuid": "260300c3-678f-4654-897e-172f450b2524", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706908854, "uuid": "90f0a1cf-4c1b-4ad9-8480-7607cd5fafd9", "value": "6144:aYvvJmwfqDKXe53ikFpgla3ivGOJPZVw8Kx3igyR+48JlUjDSGxBt383Kmxp:82Xe5ykFpgui+gh+iG48JSjDSwBtDm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706908854, "uuid": "000638a7-ca5d-4bf6-a296-cc0044f26122", "value": 335872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706908854, "uuid": "b92e6d89-1292-4d58-8ff0-a8902f2370f4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706908854, "uuid": "c2af13f1-0d1d-4f12-a5f7-d04b15447f66", "value": "1fc7da933276f6269605ed9a727d080e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aaeedda1-c1c8-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RedLineStealer)", "timestamp": 1706877810, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706877810, "uuid": "5b19eb0b-c7dd-46b9-8f3a-43ee846e3e04", "comment": "Malware payload (RedLineStealer)", "value": "09abd5a58c52763402280a1640080775", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706877810, "uuid": "27245095-06ab-4f90-976a-bea50ef373e2", "comment": "Malware payload (RedLineStealer)", "value": "b97ab3270e57d03250b95ef3106d11b92dbc60f893dd1f3a838cfa959887b4f1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706877810, "uuid": "e8e16960-e872-4022-a9fc-8282d2cdd526", "comment": "Malware payload (RedLineStealer)", "value": "6f2481bb04c692ba509368ff8b22d30529191335", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706877810, "uuid": "8aab140a-8a35-4239-b3b4-be857b4124d3", "comment": "Malware payload (RedLineStealer)", "value": "4e6d08a2071ff39b950837f71c2f88b3ee405cf0b71993b13dfed51abec0b5c5e0f4a4d9d4e37ae3b3cfe809b8bdd71f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706877810, "uuid": "ca971baf-e4c9-4134-9640-dca6aaf12b0e", "value": "T116559D3E73938025FEA69D735B59B3035EF87D25C1F385EE12B83969A870171122F262", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706877810, "uuid": "326c6c42-a01e-407a-9117-d1095648ec4a", "value": "afcdf79be1557326c854b6e20cb900a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706877810, "uuid": "d5b52875-e261-4218-ad07-ed3acde3fd80", "value": "24576:GAHnh+eWsN3skA4RV1Hom2KXMmHaBB7iouC8K/KQ5:hh+ZkldoPK8YaHOHC8Kx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706877810, "uuid": "7cc54d0a-d0cb-4352-a298-f1bb3464a405", "value": 1338368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706877810, "uuid": "73a51d0f-a8c9-4ad6-bce7-9e597aac526d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706877810, "uuid": "c3a0f235-6480-4721-91aa-b98ecf209bd5", "value": "SecuriteInfo.com.W32.AutoIt.XU.gen.Eldorado.16332.16446", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "959b0f73-c16b-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Smoke Loader)", "timestamp": 1706837831, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706837831, "uuid": "5a7806ba-531e-4bf3-b659-44126ff46687", "comment": "Malware payload (Smoke Loader)", "value": "b0519e569551ebaa51c23445b51f49f7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706837831, "uuid": "9d3dde32-e3cb-43c3-aaf7-d33e00214680", "comment": "Malware payload (Smoke Loader)", "value": "ba2ff5151bb879f086b71871af9f7104cb93b325f6eb7a0496d193d4f3650210", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706837831, "uuid": "d8342f37-2821-4950-b0ae-a79db4fd2907", "comment": "Malware payload (Smoke Loader)", "value": "e95e4b517f125984bc51ee51a6b46c8b336d6305", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706837831, "uuid": "b413c956-6a18-471c-bdf7-f5821e6b7a8c", "comment": "Malware payload (Smoke Loader)", "value": "5460f6a214c5fb846b31dee46c2f509adc6463d07912723cfe02d4eee7c3f9886b1bf195012d63a84612fc9f8d14eca2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706837831, "uuid": "8f8532fb-0510-4cef-bc83-c8f1756939f2", "value": "T13A03D017A83558BCD47894B571EA78022A1CA1839AA0155C94D2BE7AB5FF361383F63C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706837831, "uuid": "db374f55-5b8d-4115-b937-e798b4f2f560", "value": "768:lumWYEIkGs24tsOuha/whIdxYsmaGD2ULb0fla:5W/IkGw5udCdtQLb09", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706837831, "uuid": "72907102-770a-40eb-9ffc-fa5943173b6e", "value": 41369, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706837831, "uuid": "06144fb6-9862-4b97-92e0-3324a9a42b76", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706837831, "uuid": "474ba912-deea-498d-a9e6-e59380f12110", "value": "fcdf869bc179759c8be3093adec60b334d25cad63b78fd3d28229b0af88b765b_dump.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a703ada-c1c0-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706874265, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706874265, "uuid": "1b35fa9c-cf51-4160-89e4-a925e61e517d", "comment": "Malware payload", "value": "a48ee000e248741247c24dc70fa2f936", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706874265, "uuid": "f8ac4b72-b0ef-4e40-956e-f6071a7b2717", "comment": "Malware payload", "value": "bb28adc32ff1b9dcfaac6b7017b4896d2807b48080f9e6720afde3f89d69676c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706874265, "uuid": "f0d04e53-1a7d-451b-8ccf-e1bde35336de", "comment": "Malware payload", "value": "4c814fe7c94e6fb4d1d89cdae7e6e83905c459d7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706874265, "uuid": "0722a118-a90e-4616-a475-fcdf64681fb1", "comment": "Malware payload", "value": "da8b8932c6531afeafe8c0a29524b3c89e27fc70b87f93a9989db6783c85753e3c8a52809aab05e63b9a29955f94bbd4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706874265, "uuid": "01690a47-bbc9-4fdd-957f-6a70c986694f", "value": "T128E5E102FBC2C2B2E59305346166A73F897BBB209734C5D797D00D6A9C317C2A63B7A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706874265, "uuid": "7d15c514-79dc-4f98-9ac1-3de7f5ca48f9", "value": "2c4818f5e9c4b9e1df3f4636304ba31d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706874265, "uuid": "340af084-181a-4b18-a984-0e6dbf169942", "value": "49152:2QX4XDWEbuWZziDdf/6BeIIvt84c9tPXSpEONhrkRSDt8S3G1u8C8PkpxULagR:2QX4XxxixCBeIIvnc99Ett53G4fzAR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706874265, "uuid": "c8899037-818c-432e-bf87-c589dd8252a9", "value": 3121082, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706874265, "uuid": "fe98955d-d2f2-46b7-bfcf-3d00210ce9af", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706874265, "uuid": "8435ae8a-1e94-425e-9cf7-61d7986e0fa2", "value": "encrypt.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61c4fadb-c1b4-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706869097, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706869097, "uuid": "4f98e5bb-edf9-48c4-86e0-13176c33ff7e", "comment": "Malware payload", "value": "461c76cdb4e5b1a5b0cf04c9adcc5f44", "object_relation": "md5", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706869097, "uuid": "f1da143f-1f51-40b8-8086-9c44af05c70b", "comment": "Malware payload", "value": "bcbf6f43aa1e0476a5d762dea4b6240345f43a9ff1a92fe6d7e3796b216abd19", "object_relation": "sha256", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706869097, "uuid": "4270b47d-2193-43bc-a6df-e581ae5822b7", "comment": "Malware payload", "value": "d880882e1954a92e2dc3054988f0c8cdeedd1e0c", "object_relation": "sha1", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706869097, "uuid": "93c7d866-8419-462b-be8c-43931a632c02", "comment": "Malware payload", "value": "9f2a9677d4188370ae03458fca2e2521acd8ed06afe30a23bac9a5bab458ffb8d6fc06e888f688a12294a756d27abf0d", "object_relation": "sha3-384", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706869097, "uuid": "c53708a8-0e77-41b5-871b-9945ffa25c1d", "value": "T1D5441209B655E86AD041EC7C9EC482DB51AEFC348F82D64B3C04F74E3875990DA1B7BA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706869097, "uuid": "a802be43-6b22-4799-bd57-f6e59741a22b", "value": "6144:5khunrZP8VNkIXpx9jxV8339sYrCdZz8t8LQEQ:5kkB8VxX/9jxVeeqCdtpLQEQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706869097, "uuid": "f46cf61a-4f75-4f43-8072-561bb2e5bd26", "value": 263680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706869097, "uuid": "c10e0eff-7e02-48dc-aad1-8b77542705ce", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706869097, "uuid": "ba78753b-d2b4-45e1-8f10-68f1aca8405f", "value": "SOA.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d47f53b-c1e7-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RiseProStealer)", "timestamp": 1706891074, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706891074, "uuid": "40073ea5-60f9-4171-bdcb-2143dba15675", "comment": "Malware payload (RiseProStealer)", "value": "46435ce1d75ad4605ad38de3b5ae620b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706891074, "uuid": "aaafc7b5-5f63-45ca-a996-b9d775d312de", "comment": "Malware payload (RiseProStealer)", "value": "c23c8f619cc9823416ff187bb44420c6543c8b00037066c3d4192bdacb17968d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706891074, "uuid": "085b0c96-190e-46f6-9d4f-c4154b511942", "comment": "Malware payload (RiseProStealer)", "value": "808a532166ec82e1bc15db8ebd28af229b7b97d0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706891074, "uuid": "fb22f9c3-6aa0-466a-8a33-3b29d2a8fb17", "comment": "Malware payload (RiseProStealer)", "value": "a71a4eaec8df838dcb14ede9ee6c588051e9684719c8094c6698c00d2b2e138f431f2ffda9f70786dbbac6bf09543d1c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706891074, "uuid": "24078517-2cc5-46d9-808b-f9d8771016df", "value": "T10FB533E4ABB2111CC0F393B8967B6C19A6631F03D8645268D1C0F55ACFFD8B9E591F28", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706891074, "uuid": "2234476f-8498-46e5-86ad-39bca6a26eba", "value": "baa93d47220682c04d92f7797d9224ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706891074, "uuid": "760e8e1b-fb49-4766-a342-aed08e4fb3df", "value": "49152:mR6Elo7ToHnZz/OohjSsz02H+ECFLuJ8N1Lt:pEav0ZDOolD0hzL7Lt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706891074, "uuid": "ba655ee9-5b54-4973-a52b-23ff87e1c30f", "value": 2355200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706891074, "uuid": "61e15717-a6af-4c64-86be-4bcd3cc4926d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706891074, "uuid": "fa5c17ac-775a-49bf-a21e-e82921a93a16", "value": "SecuriteInfo.com.Win32.TrojanX-gen.2497.16579", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ef0f702-c20e-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706907613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706907613, "uuid": "2ba3cd9a-00ff-46f1-8a43-812d1b5f282a", "comment": "Malware payload", "value": "c110d137b14407b3f3b09dedd9231de2", "object_relation": "md5", "Tag": [ { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706907613, "uuid": "2d4c1ae3-d5af-482c-80c6-9d8d49ec5211", "comment": "Malware payload", "value": "c26f1ebcd2e7c2b2dbd7a021c45028cbaeaf5d760ac525e3984ee0e36766ffcc", "object_relation": "sha256", "Tag": [ { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706907613, "uuid": "35b31fa1-aed3-4cd8-bd43-5b9e69b68295", "comment": "Malware payload", "value": "fc7e53264ce93787d25b84e92449ddbcaf7d90a2", "object_relation": "sha1", "Tag": [ { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706907613, "uuid": "04bdd36c-e9a8-440a-90bc-82d95ef413f4", "comment": "Malware payload", "value": "3f08656d0b1d00adc448ce199b81e14f7f7703f6bdb7a665e2e2eacebf6a281829e4f324d6dbb586e2eea1a71a0454ad", "object_relation": "sha3-384", "Tag": [ { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706907613, "uuid": "ec08209e-52a9-474c-953a-e84fa97fb915", "value": "T1AA7386022E5B2AD6D45876703E64AB8184A25DF5BDCB0E7920C7304BE1FBDA84CDDD9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706907613, "uuid": "7990ef8b-bfa2-4aea-86df-d2aaf6d29ab6", "value": "768:Rvrr4yDirGRG90FEVVSJK3X93wEz/4EkFTk0sS7:h4yfR3F8VSJKpR4EkFTuS7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706907613, "uuid": "cc811d52-0792-4d5b-8e3c-035f9e298487", "value": 75142, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706907613, "uuid": "6d73b181-edbb-4a20-8fe5-34ff258a3d2a", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706907613, "uuid": "ff5f0c7e-dac9-4dbf-ad42-1bf2a4e5a4c6", "value": "a58", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac69d324-c172-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706840875, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706840875, "uuid": "5ebb225e-de71-4f7b-a782-1bb708a27ebd", "comment": "Malware payload", "value": "a42544ccb127f28d8d832dc48b45ba53", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706840875, "uuid": "dada4fa3-50e6-4fed-bd0f-a60f01592cf8", "comment": "Malware payload", "value": "c445ad03313025e28d1486d9d51abbcd9a14b3b3fe7e7b4c6cfd631cb7e61a1b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706840875, "uuid": "a417078a-971e-4f5e-9e13-4308bfeff88b", "comment": "Malware payload", "value": "264833aa82bfeff346efd8453bc7a6b6a7987a66", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706840875, "uuid": "aa8417b9-599b-4cb8-b596-0c3fcc94eec7", "comment": "Malware payload", "value": "7a864525a84ab4d8eb3c8c79dc9f655ffcce0dbb7359d3e7e656a9e99d13701f4d83fbd49a4a1c372080cf82b1228641", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706840875, "uuid": "39e943b9-3b1a-4605-b43f-c130e770f19f", "value": "T19EA6233FB268663ED0AE1B7145B38260987BBF61B41B8C1A57F0280DCF764715E3E619", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706840875, "uuid": "e2bb01bc-dee0-4b28-9152-590f33ef54da", "value": "5a594319a0d69dbc452e748bcf05892e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706840875, "uuid": "5e03f0e8-3fe4-48e5-b79d-35d99f2cfcd7", "value": "196608:p8VDb9eRara4UkLYPoyaKJgMd7MDqx6bbFWdhYCIoBvE1VzLu:4ZBe0my0d708Kk0oJAV/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706840875, "uuid": "43b81605-f7ca-43b4-9cb4-a887630005cc", "value": 10186280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706840875, "uuid": "23f5b163-5589-47d8-8034-6180630ebd2e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706840875, "uuid": "0f328f31-78cc-4e6c-9aae-dd4fc85a19ad", "value": "SecuriteInfo.com.Win32.Malware-gen.18718.6982", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "876a3a89-c214-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706910392, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706910392, "uuid": "07860542-8a65-4eb4-82a7-d73b4ec40cb3", "comment": "Malware payload", "value": "356f842db1d8263efd14d67806f00bd3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706910392, "uuid": "b2449526-77b8-4e07-b181-4865e2dc42bb", "comment": "Malware payload", "value": "c4d4e753b728a7a677b76270cd1a8c16e47fcc7fbf69575185e1c4e288ea43a3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706910392, "uuid": "25a9f8ed-26e5-470a-985b-f9b6c2bfa7f8", "comment": "Malware payload", "value": "8cfe45a813bf22bfbf113fe45527b6014344a445", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706910392, "uuid": "4f335add-717e-4ecc-a405-c562dc8d970e", "comment": "Malware payload", "value": "fbbe1df811b8c1e30798c43f553bfad9b2ea64d3653d49111b753ca8a2326fd014b294d3116b5acb5f8550dc0ce300bc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706910392, "uuid": "2fe7e127-e04f-4951-a73d-bb2dfb0b196d", "value": "T1F4B533F7C53649CAFA37837066458251DDCF6C2BA35A1A2A94D5FC2203BF2324197F26", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706910392, "uuid": "2112f748-6b93-4312-8d17-5c9cdc729f54", "value": "baa93d47220682c04d92f7797d9224ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706910392, "uuid": "3a79e961-f6cf-49f3-a82a-5ef4cea0bc79", "value": "49152:7dc+m9q4GILYxlMYZ8O49QrOnPyG5b+DUQHO5MBAu3chJHBCV13vHir:Kb9q4D+SC8O498OnPtF+D2JwaCir", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706910392, "uuid": "a8ac53d9-c93e-4089-a81b-cd4417789437", "value": 2309120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706910392, "uuid": "e9d7bc80-76fb-4786-9734-a499cec68f29", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706910392, "uuid": "91d2d235-9815-42d8-bb03-274c115afe0c", "value": "SecuriteInfo.com.Win32.TrojanX-gen.1550.22003", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3afd1406-c17a-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706844121, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706844121, "uuid": "0e1ad25b-c4ca-4550-8bb3-d537b3c241e9", "comment": "Malware payload", "value": "7f96a223916b4b1e2ca835421a5d1ca3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706844121, "uuid": "108be6d8-71ca-4d92-9ede-b8ff0061d00a", "comment": "Malware payload", "value": "c5183395078c4babea65138a2fde3a99ede0bb4a63116194ddd7eb8ed76c03d1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706844121, "uuid": "14eb6cad-1b1d-492f-91b4-82e856585f91", "comment": "Malware payload", "value": "2549dadbe3f664f94cffdc071a8f65e368c1316a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706844121, "uuid": "85c15e28-e960-43a4-b466-859372948a85", "comment": "Malware payload", "value": "76078433b39e4d61902e8e39d3dca4d090079ed5d9f318ca4f1066cee1a43e5d195f2184995836b411a25563ebb71605", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706844121, "uuid": "aa70d858-d29d-4749-863b-98435d55ced1", "value": "T1EE47334530AF64B9DF28C47190F0B9B4566F8C3ECF6B60269CC27B098476B96973612F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706844121, "uuid": "4795291f-47a0-4901-bee6-8d0f6993cf78", "value": "4d65eb009a5bed7efce0091931f34eb4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706844121, "uuid": "a1c51fbc-4a22-4f99-81e6-0a83dd5b5c51", "value": "786432:Uh9r6Tva2jPjE19CFl6dAhh9/y152cxnkBgX3z:Or6ja2DG94Bhz/XYnkw3z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706844121, "uuid": "ecd97b5a-447b-4518-b03a-3087dc99778e", "value": 25401728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706844121, "uuid": "8518dd66-a96d-4ffe-a7ec-e34b3e40edfd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706844121, "uuid": "06554fcf-782a-4353-9265-bc335442212a", "value": "SecuriteInfo.com.Program.Unwanted.5457.27113.31250", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3465f147-c17a-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706844110, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706844110, "uuid": "d96185f5-21cc-4ee5-b70d-767118fc2675", "comment": "Malware payload", "value": "53228721d5dad69a41209fc2d455636e", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706844110, "uuid": "877217d6-a576-4aa8-b4bd-eb17413ac029", "comment": "Malware payload", "value": "c5593db0f5cc604f95ff24a5b728bba9237340c50e16025abeb19f8e93cbd13d", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706844110, "uuid": "38489be7-75df-47e6-991f-88f5f26c8daf", "comment": "Malware payload", "value": "5faf1b03d03992967773e93078cac66e8f75b874", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706844110, "uuid": "73b214c2-d220-49b1-a107-3be593ed544f", "comment": "Malware payload", "value": "d027c1b98897e17145b6ac02792070cc7551ba63a2dbbf6c2fefbab1385619d026c4deab0e76140ac041486961a13766", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706844110, "uuid": "4bbe61ca-f344-411a-ba3e-c8cac8bde0a5", "value": "T1840520036F44DB15C97C353A82FB292863F1F5CB0771895FCF0576A62CC62A6A9CD24A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706844110, "uuid": "d246b34c-80b9-41c6-b726-79abadbc63be", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706844110, "uuid": "66943a29-0609-403b-8b2e-fc62c2816439", "value": "24576:KfHquIfwIOzKsrgEFFNpMZwLv7oGzJLaG:8HquIfwIOzKsrgEFFNpMZwLv7o0JLP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706844110, "uuid": "8fe07456-15f2-4dd1-b5e0-921de01f371c", "value": 849920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706844110, "uuid": "c2b754da-cffe-4af9-ab84-6126ec91b917", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706844110, "uuid": "4863371a-0aa6-4d85-9c1a-9bbcb59cec7c", "value": "SecuriteInfo.com.Win32.MalwareX-gen.4894.21830", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d5d6fc8-c1d2-11ee-b7ea-42010a9c0006", "comment": "Malware payload (CrimsonRAT)", "timestamp": 1706881974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706881974, "uuid": "200d2c32-1137-4177-9e73-9b3c7dc32653", "comment": "Malware payload (CrimsonRAT)", "value": "a21c2b37effe3195665ec5597afa329f", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "docm", "colour": "#502578", "exportable": true, "hide_tag": false }, { "name": "TransparentTribe", "colour": "#862286", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706881974, "uuid": "862b1589-4026-4dc6-92c6-e7e73487e37f", "comment": "Malware payload (CrimsonRAT)", "value": "c59b2d6a70bc5b84998aebb2d21241a8adef33724838e92db4dee36a1ce46f43", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "docm", "colour": "#502578", "exportable": true, "hide_tag": false }, { "name": "TransparentTribe", "colour": "#862286", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706881974, "uuid": "41e5cc2f-e389-47d1-8593-2326cc9c06b6", "comment": "Malware payload (CrimsonRAT)", "value": "d764529d82a015204d9ab3fe414c0da5b9829d9a", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "docm", "colour": "#502578", "exportable": true, "hide_tag": false }, { "name": "TransparentTribe", "colour": "#862286", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706881974, "uuid": "c73c5515-db70-4e13-9a54-6a00885af865", "comment": "Malware payload (CrimsonRAT)", "value": "9d3ab4e68d556cf7ee50842337493bf23c13e300b03bddb41acc4e8ad6b754564dc5a8646ed2b3261697a042423c79f4", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "docm", "colour": "#502578", "exportable": true, "hide_tag": false }, { "name": "TransparentTribe", "colour": "#862286", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706881974, "uuid": "7728cbe8-4164-48d6-95c1-1703fe993761", "value": "T191F6338837322DB56B1014BA944FF6393327079001F77D5BD2A2A33A5A5A4F38F1A59F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706881974, "uuid": "c955e9ab-dfba-4040-ad7d-1f05ed66f0eb", "value": "393216:Xrh68BRtZSZlpwMkbt6xFczuZQ5x2hYUiF9:Xrw+aKMkMozuOD209", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706881974, "uuid": "96f007e3-2ad5-45b7-8898-da9245920c27", "value": 16637332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706881974, "uuid": "a0451eff-48d7-416d-ab95-f1476efc618d", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706881974, "uuid": "e1388405-4dac-4ff1-b129-4f68514b67cd", "value": "Recommendation for the award of President's.docm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7089043d-c1bf-11ee-b7ea-42010a9c0006", "comment": "Malware payload (GuLoader)", "timestamp": 1706873846, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706873846, "uuid": "9457c876-28d9-4c42-86b4-bb1f6205c79f", "comment": "Malware payload (GuLoader)", "value": "45e7b7d8ab31b94a9e4bf8e22b1b749f", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706873846, "uuid": "55d6f1df-6cea-4f2f-b7f2-0a7cc4096119", "comment": "Malware payload (GuLoader)", "value": "c5f555b7dc5272e5df9400dea083442efe00d8745f3bd501f3919814ba4c22ce", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706873846, "uuid": "c8b63170-bbc2-445b-888f-1f9932be1a13", "comment": "Malware payload (GuLoader)", "value": "f2c3970805250494f24e625e56a638725dc4a2b7", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706873846, "uuid": "bfa02d94-2c41-40eb-bd3c-0023fbc3fa3d", "comment": "Malware payload (GuLoader)", "value": "a4937544bda51fbe35fc3d170b0dcbb13f9f24c47fbcfb18810ca30d86b503da73fa95e4ad4c97c3ca317ac3f35f7205", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706873846, "uuid": "293390a3-4ad2-4698-91b0-500f3b3e0de0", "value": "T175E17C23E7C50763CEAEE2F39D1F7E0A5674B94997C006522295CA072F432B95E850B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706873846, "uuid": "1d3038ab-5c72-428e-997e-4934378b5fe7", "value": "192:40ncDUsY0Dt0LbyqYeL9fKCdybCIQKuW/Hciu65x5mYK:402Us0LeqYeL9zy+Oz8iu65U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706873846, "uuid": "dbfdaafe-cef1-43e2-8ea1-be94ad445d7d", "value": 6815, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706873846, "uuid": "e955ce4c-4c40-4ed2-8d11-99899dbb9c4b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706873846, "uuid": "0fc00904-3654-4661-9139-46f07c5d6205", "value": "screen_image.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f8cc7fc-c1df-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RedLineStealer)", "timestamp": 1706887535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706887535, "uuid": "bab4ac60-993e-4742-9ef7-0a9b0487a8c3", "comment": "Malware payload (RedLineStealer)", "value": "7b024c10e96bcf76e5ed1aa7205a7980", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706887535, "uuid": "a0524701-5780-4fc4-a7da-04592535790e", "comment": "Malware payload (RedLineStealer)", "value": "c5f87c7ded849b68ba753db4a4b0cca214ca13826fc7bbb3837ff37a772553c8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706887535, "uuid": "f1b9ba14-5cf1-42f0-8f3f-128ab657caa2", "comment": "Malware payload (RedLineStealer)", "value": "a8d7ec8420ff65bc82eb58c028281cc6e5e00b01", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706887535, "uuid": "fe0b5109-f1d4-4290-81a1-a11fe6ff45b3", "comment": "Malware payload (RedLineStealer)", "value": "3dc6aeb211b39de18b521f1fb3e0bfb61a2618b072a77ac1d01e68954d2adf38de8ae9d7294be96be3d9287e08d6eb55", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706887535, "uuid": "8e8e1e04-552b-4056-bd85-38d4443d80da", "value": "T16CF4122134D1C072D4B6483148EACF6A5A697472177AA1DBB7EC1B796F613E0B7323C8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706887535, "uuid": "cd9dccfc-8a66-4bdf-8201-86509774fe06", "value": "bf5a4aa99e5b160f8521cadd6bfe73b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706887535, "uuid": "d669d1cd-f0e2-40f9-bbbf-492d7497bef5", "value": "12288:/h1Fk70Tnvjc0MWI5yUlaETvXgHI8v1NzcmUVHiQ/eEfW5uUCeSx8:1k70Trc0FaaEQFt1liTGEe5uLO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706887535, "uuid": "9be0c056-9630-4b21-b968-2f3b5c470114", "value": 744192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706887535, "uuid": "dc5cf9bb-6c8f-450f-b239-794bde452e8e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706887535, "uuid": "78faeaa0-7c9c-494e-9490-caf5fefaf29b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "812982f8-c214-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706910381, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706910381, "uuid": "68b1abe9-f740-42d6-810c-7a4378ecc0ad", "comment": "Malware payload", "value": "bfebdeb011370eafc536e2ba81e0eec8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706910381, "uuid": "29de77e9-18dd-4ddc-af37-d5369d8b82fb", "comment": "Malware payload", "value": "c91a75e0b14e6256b3e68dff7af7e9623cb586e2f7e49846a740ecf55d34885f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706910381, "uuid": "b59e7bc3-ddde-45b2-9d1a-55005201a2f9", "comment": "Malware payload", "value": "85f80cacf1f1ee7917f05474b1007658577de6eb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706910381, "uuid": "c307ac97-8b34-4011-a5c6-e970dcdc4531", "comment": "Malware payload", "value": "0154251ba2ecafa9abd5675e6717e5985566628f18e72d11bfde508a6198265aa4e4ba56c5456c883123dc00886f1f7d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706910381, "uuid": "a07b240e-ebc6-4e48-aacb-a37c01faf12b", "value": "T1CFB533E12A35D582D98B87783007578D728FADAB44EC499C8D24F360637E338D919EF6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706910381, "uuid": "f02ab89a-edf8-4271-af6d-0f0cebc9fa50", "value": "baa93d47220682c04d92f7797d9224ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706910381, "uuid": "46e4adeb-8271-4cc6-adaa-a535dd58cedf", "value": "49152:QOreNYF5s3HEh71vlVdoqMc2SeeEzsPfXzSqTXC5e:QXkS0dVlVtMc3EufzTXo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706910381, "uuid": "0b92a017-339c-42ab-91a3-71ab828947e8", "value": 2342400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706910381, "uuid": "74caf9e5-d7c1-4948-b3dc-df30a6ecb736", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706910381, "uuid": "c7dc417c-b265-43bb-b119-4b113d40d52c", "value": "SecuriteInfo.com.Win32.TrojanX-gen.17533.12813", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12df97b4-c197-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706856509, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706856509, "uuid": "3fab6e7c-59ac-4961-989e-a3f0a6c0974b", "comment": "Malware payload", "value": "cbc505f641440605f4802433fe49e1c2", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706856509, "uuid": "d916edf7-0c16-4cd9-b1f7-2040b2096f0d", "comment": "Malware payload", "value": "cafdec23e5a8ef43b7bff85c42f03c1fba2ced512716a2d1ddd2f21fe0cf4cc1", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706856509, "uuid": "cdd1e7dc-ea70-4d03-a5ec-a78973860537", "comment": "Malware payload", "value": "95ee52476158c4700c43a00d6c1b953e4140f7ab", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706856509, "uuid": "45fd5605-0fe8-45c5-84ed-39738e9ecdf9", "comment": "Malware payload", "value": "74ebe8a5ffcffe7e4ed007637d60dfa2c61a57c78e2e62a4d84161e57abfa41a6818b8da6835dafd430b2d29a2e80527", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706856509, "uuid": "43364c67-25e9-41f4-9f8f-5451386d7c68", "value": "T1A8C30B5819F67409B2B79EB6E7E9E4D6923ABBDF7E1A444E114083830F117C0CAB3536", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706856509, "uuid": "c19d54c6-edd6-4a60-8f9c-6099a94dffcd", "value": "768:wZTTTTgsTTTTh7TTTThGfTTTThGfTTTTh7TTTThG0TTTThVLTTTTh7TTTTh7TTTL:wnjz9DB9i5g6sv+Ve", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706856509, "uuid": "f972ac54-a643-45ba-bc40-4c107940f02a", "value": 129110, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706856509, "uuid": "27dd44c5-1c07-486b-a7db-a6aed012a763", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706856509, "uuid": "704c1c96-422c-4979-8851-32be472de24a", "value": "visa.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9599a16-c1b3-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706868895, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706868895, "uuid": "cfd934e2-dfde-442e-8396-3aa13cc17ac5", "comment": "Malware payload", "value": "4fa22c92760953bb0231b5f75c45e9b4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706868895, "uuid": "51e08fac-14e8-470c-b783-3c4b1ea524c8", "comment": "Malware payload", "value": "cbd60fa4583117a94856dddf623e220d677fd181701c294e7d27629f840ec584", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706868895, "uuid": "3889dd46-c979-49c1-8eca-ad9211335d25", "comment": "Malware payload", "value": "4f16c8ce4aa612eea67a3462ace603c80e387f7e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706868895, "uuid": "483facee-571c-4967-ab2f-858a9b4f7f9a", "comment": "Malware payload", "value": "42da951e7abac5bd39f36161feacd7e98e827e448143b28e8afcd6c1aef579bcd0f0fa10fe3e827032bcfb640e9920b5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706868895, "uuid": "0d95759a-e4fc-491d-8ac9-89dcda9014ec", "value": "T176D318067B0D0E43D1633EF0277B1BE0879EFD9229B4A580B42EBDC992719F11586ED9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706868895, "uuid": "4332c142-65cb-4aa3-98c9-f4116d497e27", "value": "1536:cL20SIZIx6hQ/P8c8xrucex9qYU5T93nmxbfT0vAy9gaFhQm0AlXv:cK4IxIM8oTSTJof9ytv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706868895, "uuid": "6d09917c-ecab-435d-89b9-508f593b524b", "value": 139100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706868895, "uuid": "0caa6948-1791-4336-87c9-d0b4cf867081", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706868895, "uuid": "f428c99a-12fb-4d80-8752-0670b24d6635", "value": "4fa22c92760953bb0231b5f75c45e9b4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05c9ce36-c1ae-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1706866366, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706866366, "uuid": "3042bcac-881e-4af2-b80a-118c3c04aa37", "comment": "Malware payload (Mirai)", "value": "b6fa6611c9661abf07eab3dc336587fb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706866366, "uuid": "7200756c-4963-4dc3-9661-119d95ad6cea", "comment": "Malware payload (Mirai)", "value": "cdb074c69a92aae355a8722626d03f1bb3c4e46f897e45760faa52d72a6e5135", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706866366, "uuid": "51cb8ec8-c636-483f-a452-0c34b873aa3e", "comment": "Malware payload (Mirai)", "value": "63d3a39277bf078b1299a15f25e7c6f5813cccb8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706866366, "uuid": "1e57574a-676e-4e14-b860-a13f3b71a063", "comment": "Malware payload (Mirai)", "value": "99c922477b3613fe65cff2f73d264819ac06d81984ba28b07d8acc49517d7ec24d43266efa03bf1fbade0ef7d6c4bf5b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706866366, "uuid": "4ef241ab-1be9-46e2-81a4-2727f0dce36e", "value": "T13653F946FC818A11C5C91376FA2E118E33136378E2DFB2529E106F6477CA96F0E7B952", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706866366, "uuid": "3e47b73d-3325-4245-891f-b3ef8a504e2f", "value": "1536:0pnZdQzsIwIK2QAwUiE9W1HwapaczKxWRqVUcx3eL9IBiDemlZWk:ISwIeARisWHwNczKxFVUemlZWk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706866366, "uuid": "8fd17435-8180-4faa-8bf9-0f289d47b23a", "value": 63184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706866366, "uuid": "2927cbb3-f612-4266-a29e-d732b614cc5b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706866366, "uuid": "70a51f85-74a2-4679-9eb9-e553fa4c6d65", "value": "b6fa6611c9661abf07eab3dc336587fb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8d673a4-c1ad-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1706866344, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706866344, "uuid": "59b12117-c9e2-4b72-adb5-992abb79b74e", "comment": "Malware payload (Mirai)", "value": "37e699c315da5b8459ef42ef2dd14eba", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706866344, "uuid": "2f2c1212-f8bd-43f1-990c-31ef9e802f88", "comment": "Malware payload (Mirai)", "value": "cdbf54148c6780efb8c5f5735554c51de11cc5b2f0cdebac997348061728a00a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706866344, "uuid": "066353c0-45f7-4947-9f75-7746f386121b", "comment": "Malware payload (Mirai)", "value": "234cbeb56653b1c31b7bfcc98104e347db5b77d2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706866344, "uuid": "3383c8a9-4eec-4a14-929e-97fbfe86d578", "comment": "Malware payload (Mirai)", "value": "11310ea472386f25a0d55b3d0f3761f494a0ddc2f35a45ebf353625a58586bf6bb3f788ce45af85eb112b913dd3506e1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706866344, "uuid": "b800cb45-01a1-44bc-9b2a-6924777a4604", "value": "T1CC434DD5B401DE7CF98BEB7A80224A09FA35726154A30F27A267FD93AC720564C2FD47", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706866344, "uuid": "13b93e8a-e61f-4731-95ba-f6b08a5fd128", "value": "1536:LtCdFUWyWse2sRP876Xy8mCkBnKSQDVMQFM85:msDsR5XgLNmM2b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706866344, "uuid": "93346d00-6bbc-4b7d-a5fa-7ee0a4b48bc5", "value": 59720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706866344, "uuid": "60b4b0bd-86d4-43a8-81bc-1c42ebe4af0f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706866344, "uuid": "d1af8e2f-ca39-41f6-bb19-410f89db2281", "value": "37e699c315da5b8459ef42ef2dd14eba", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35e90270-c169-11ee-b7ea-42010a9c0006", "comment": "Malware payload (DCRat)", "timestamp": 1706836811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706836811, "uuid": "2c53716c-7412-49fa-a694-e24083d8f5bd", "comment": "Malware payload (DCRat)", "value": "b14d41ca84b9014a1d5018815202356d", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706836811, "uuid": "eb846dd2-b831-4f47-a858-e29f0c2f4146", "comment": "Malware payload (DCRat)", "value": "cebb491e8af42508a08b3d72e299bb73ce764dbe0697aa86d5e300ff50cfeb69", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706836811, "uuid": "99e1fb3d-0192-49ed-bcd4-caf3a10a9f34", "comment": "Malware payload (DCRat)", "value": "29efe05509f0ed6963e0f231d5eff008c2008f60", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706836811, "uuid": "6c0c8108-5c60-4636-95f5-c1e3fb3094fc", "comment": "Malware payload (DCRat)", "value": "504d095a47412433fae2f85595fb775ee97e2b999d86eef9d6c5088d2a0469585f96490c48ac8f20e351aee7f001f42b", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706836811, "uuid": "455ec7c5-c8fd-4564-b1b8-663b820dcdee", "value": "T166F5E006BE44CE01F0091633C2EF455887B49C516AE6E32BBDBA376E55123AB7C0D9DB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706836811, "uuid": "46c61c3e-6de3-48b0-8452-8c532873b4fa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706836811, "uuid": "2b62f11f-f7ff-431b-affc-10546bd84a1c", "value": "98304:WsmfE8eD0M782w1JSdvi199xP9/ecsFjPSz:WQNBY2S99xl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706836811, "uuid": "45c83751-9614-490f-a532-ed739f6e8ea3", "value": 3358720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706836811, "uuid": "cd3e5dbb-65f1-48c6-ad94-b39a83218379", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706836811, "uuid": "a897f40e-1bdd-47c3-b77c-77da1aee887e", "value": "b14d41ca84b9014a1d5018815202356d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95042622-c1a5-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706862740, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706862740, "uuid": "62c42d4b-3a8f-4926-b5d3-5e69289fc9f8", "comment": "Malware payload", "value": "6c1e3c565ed05f74936a35f0e5c01779", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706862740, "uuid": "88ef0a41-4305-4287-8fd0-f30097da2698", "comment": "Malware payload", "value": "cec83765558568a67ffecb2db85c724fabfa55db03fe8941c40ecbb47929c258", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706862740, "uuid": "8151135d-4b0c-4df5-8d66-a810268b6e9e", "comment": "Malware payload", "value": "40e90e006de862d1613c902eb2de22eb827f2057", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706862740, "uuid": "5620a41d-fd73-4e91-87f3-2a439c5172b5", "comment": "Malware payload", "value": "51d031de6b8434df54b4e53c8b38488a215bf26e3033ca6bb65e8cd7105c46fbd88965f49776bcbadaac773b1ce4914e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706862740, "uuid": "abd90cdd-2f41-444b-8c86-86a25f2db31b", "value": "T1C2A48C96B2F404E9F0B75138D5ABA22BE5723444073087CF23D45578AFB26E1A6B7F12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706862740, "uuid": "839611f0-7f5f-40ba-8b8c-2801a245760b", "value": "248044d32c66a35725d285fe7889e456", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706862740, "uuid": "d928acfc-b6f8-48cb-9499-d2a84e4ec4d0", "value": "6144:4aU2JvWmWA7z/Fv+nDLLtRrNQEAnTXJllCOsCWSz5Ch9lEznvEeoPn2eK:4al7ztv+nDNRxQpXejSYEznvu2e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706862740, "uuid": "10193efe-de0a-49af-882b-58f98fec6ef4", "value": 470016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706862740, "uuid": "dcdffa7b-4d41-4f9e-8506-f1632a76c62e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706862740, "uuid": "afe3934f-1eae-493d-a386-b2481fee29b0", "value": "SecuriteInfo.com.Trojan.Win64.Krypt.31273.19496", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d156da51-c1a0-11ee-b7ea-42010a9c0006", "comment": "Malware payload (QuasarRAT)", "timestamp": 1706860694, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706860694, "uuid": "260a6937-7f72-464c-9d2b-4ea3ccd9cc8f", "comment": "Malware payload (QuasarRAT)", "value": "82d4e67c05db98a6f3aa83bfd680f693", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706860694, "uuid": "a963a621-0fd0-4ffd-b024-ab594cad5929", "comment": "Malware payload (QuasarRAT)", "value": "ced760664a7c5580e324d99d695b119c1f3ec94d1d9c56d1d3882347f0c6eb10", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706860694, "uuid": "99e93ee2-87ac-418d-85fa-682d52f74495", "comment": "Malware payload (QuasarRAT)", "value": "edea0473f4a1028685b6aceb1f61c4495c36041d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706860694, "uuid": "5eb246ef-4008-4753-9048-cb25d2ace044", "comment": "Malware payload (QuasarRAT)", "value": "bc7e5c0e5ccf57908cf08ed2ad9136283d443476cb738af1a6a72b711cd7e5e4a5e95ff4983d4d42edfdade7a7ad8c1c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706860694, "uuid": "7347ce8a-f417-4ae1-9726-8d9dbfd38d47", "value": "T1F1E56B143BF85E27E1BBE677A5B0041267F0FC1AF363EB0B6581677A1C53B5098026A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706860694, "uuid": "acbff6a9-670e-4d2e-a26c-1d1d03dc2c2c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706860694, "uuid": "654151da-b714-465e-b2ea-93e9670f4f20", "value": "49152:3vEuf2NUaNmwzPWlvdaKM7ZxTwfYRJ6qbR3LoGdgTHHB72eh2NT:3vzf2NUaNmwzPWlvdaB7ZxTwfYRJ6E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706860694, "uuid": "9be169b9-2c74-4ec4-98f5-fa8a6f162a37", "value": 3266048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706860694, "uuid": "41d3aa32-3781-4f70-ab9f-86a47b99aa43", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706860694, "uuid": "5daa7686-9f9c-442b-8c2f-1bd74338d20e", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "022aaa91-c1df-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706887405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706887405, "uuid": "8e801f54-b6e3-4c3c-9442-bc180ff6f263", "comment": "Malware payload", "value": "d49119bf618d8a8cc20b5f3c8013cfa7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706887405, "uuid": "c11d6874-218b-4280-bcae-da2be3450f59", "comment": "Malware payload", "value": "cf4b5f4cea12dab57be2d970addf079cf8b9d28a65f614afb05a3203970b5f80", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706887405, "uuid": "deeed08d-3f4e-4d5e-b2c5-14dbb88fb00b", "comment": "Malware payload", "value": "4874659dc6a372e0b36d034bd6d368109cd4d734", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706887405, "uuid": "d62e608d-8ddb-41b8-8e1e-1ff6bd96e50f", "comment": "Malware payload", "value": "4c731b7ea3650309ab65cce09062a8808244c6597d5f9ada9136f43d774c6d8e5aebb67ce361d614cac6e849f021f28a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706887405, "uuid": "61c2e45e-437b-4954-b498-2d7fc882b760", "value": "T1DFE372717D034CD7C116AB3610711A3E25EEDC81DA89F36FA049F6DA4AEE46009FA3D6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706887405, "uuid": "6cd3fb97-ac5b-4a38-814e-c72fd1b08c20", "value": "3072:cxOX3H7mhm49HIb3uTdHKK8D9ByNWEDAUqIO1iiRNEI+:cxOHHKhm49oawIO1iiEI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706887405, "uuid": "bea5e6ad-9893-4c7d-adff-a1942efcb932", "value": 155648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706887405, "uuid": "00324acd-126a-4848-a57a-a9b871008b0f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706887405, "uuid": "330fa51f-73d0-49bf-a4d2-5ec6ee20276d", "value": "SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.3441.2268", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e66ddcb2-c1b3-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1706868890, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706868890, "uuid": "5de882bf-5b6f-4726-a31a-2a3a3a2dafe3", "comment": "Malware payload (Mirai)", "value": "660a611c81cf0de85e8774d45e42a08d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706868890, "uuid": "c3b20c45-614b-4e03-ae7d-3f1dc0a0effb", "comment": "Malware payload (Mirai)", "value": "d056c0b7f398a447c1efe4045b49d24833799fec2af76a5dc92625d2a95e07d8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706868890, "uuid": "4748e2d2-0313-4abb-bdf2-824621641060", "comment": "Malware payload (Mirai)", "value": "1d2a8db99f06bfc347da34431e4e37e02a6e10ae", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706868890, "uuid": "5bfe4e0c-3187-4543-9d73-55d614560017", "comment": "Malware payload (Mirai)", "value": "6349151e520b1633d208eb1ccd1b42e6bef896d1093a081a8e727daeaf83fdc4308951fb8330759f81c6265e84d3312d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706868890, "uuid": "71649644-8c89-4f8d-97bd-3b148085664c", "value": "T1AE331795F9816663C1E415B7FB4E418C7B2603F8E1DE7303D915AB303BDB8AA0EBA451", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706868890, "uuid": "26fd623b-5421-4eb0-8e85-902fa508997d", "value": "1536:ZAzdY7GFiw8Ex/QHFMwNR+crHemBJfOOWvFn7vSqW6:ZAz67GFiw8Ex/QHFMwNR+UHPB4dbSq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706868890, "uuid": "455b5f00-72c5-4b01-bc03-630839412d4b", "value": 50896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706868890, "uuid": "50fd9114-33ee-440a-8d04-bceaf792f32a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706868890, "uuid": "90682b81-e891-4784-9670-79cb49ec2486", "value": "660a611c81cf0de85e8774d45e42a08d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7791463-c1b3-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1706868838, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706868838, "uuid": "7d8be170-5266-4008-81c1-dc1b901361c2", "comment": "Malware payload (Mirai)", "value": "79ad7865e38f34f18ea101e9e4ff7291", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706868838, "uuid": "8251675d-9205-4a89-b0d3-d20d65e574d4", "comment": "Malware payload (Mirai)", "value": "d0d52e7c7b414b90025991f1b3ba658ca42a659cb5798582a9dba614e17e8508", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706868838, "uuid": "fa121ff7-5507-4759-a308-6c82f87e7dbe", "comment": "Malware payload (Mirai)", "value": "78ec17dbb8e1739de7969d4caede41602b292506", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706868838, "uuid": "1584dd5e-7a8b-4f78-a8f5-7d8c8dbbb5b7", "comment": "Malware payload (Mirai)", "value": "d5974201b98f6983b044f7231cd97d470ba5a9ad028ea77a7ffd162bab26c9191d12951645de9b0bf1bf2eaa60ae75ae", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706868838, "uuid": "2aaa6b2b-fc19-4662-bfed-1c94ec9e8e93", "value": "T1D8232841B30E0A43E1A76FB46A3F17D6A399F95031E4A584264DEB4ED631C324ACEEC5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706868838, "uuid": "e2a3fd4a-f8e0-4702-a87f-ee8c50165c2f", "value": "768:8TsGnbO7kw1oylDFW9FxzZYjKfoPe13BFqKtaMmIv:6bO7kw1pluFpZoKAPel2KQMmw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706868838, "uuid": "c1313a91-44be-450f-af15-5197316fe4f9", "value": 46516, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706868838, "uuid": "68364347-b7d1-4b8a-a12d-9ce404e3de4c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706868838, "uuid": "20fe9841-921c-4344-a0cc-822b6492ae3c", "value": "79ad7865e38f34f18ea101e9e4ff7291", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd9ce508-c16a-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706837495, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706837495, "uuid": "5ef18640-01d4-4098-bbb5-44c6dda9273c", "comment": "Malware payload", "value": "e864af29a4138cd5286d6fc308f62dcf", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706837495, "uuid": "5368c724-f984-4afb-838f-fcb4657819c9", "comment": "Malware payload", "value": "d0dac40bd6e3d20c70066ca50d81fca19c2cd123cf7c2eea03c5ee94153799a8", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706837495, "uuid": "aa55f155-5f2a-4bcc-96d6-bef26f5759e1", "comment": "Malware payload", "value": "93d790b5ca87e65e30b37186e09bfa046bf2209b", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706837495, "uuid": "314c3256-90a0-4426-a69f-885fb1921681", "comment": "Malware payload", "value": "0b840ab54fe289fc46dc6008ab4955c6635424c177099f91737b9783ed975972785c279431ec438d75c7089ed4a68ab5", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706837495, "uuid": "689497ab-77d7-425f-a2b6-97b9bef79be6", "value": "T1C0C312D6EC26E500F1970A7F491958F678028010E6A4F13C6D96E67FC8688ABD7EFC5C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706837495, "uuid": "e8c01e2b-dacb-4eed-9923-3daf5180563f", "value": "3072:ohfkkCUl7ZTB+jZzVE/Khz7XgOV+yNpr9K:ohfkkCUlNB+jrEoXfV+yDrA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706837495, "uuid": "cf0545b7-9054-4b76-ba2f-a87648228faa", "value": 123227, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706837495, "uuid": "13d8681c-7c8a-4087-9c0a-5a3bc1cf4130", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706837495, "uuid": "6fce6fcc-f530-4808-8a56-3d14be6c3206", "value": "\u0432\u0456\u0434\u043e\u043c\u0456\u0441\u0442\u044c \u043f\u0440\u043e \u043e\u0437\u043d\u0430\u0439\u043e\u043c\u043b\u0435\u043d\u043d\u044f \u0441\u043b\u0456\u0434\u0447\u0438\u0445 - 11 \u2013 \u043a\u043e\u043f\u0456\u044f.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eaa60289-c1c0-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1706874480, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706874480, "uuid": "82f54e1a-4354-4ca5-a17d-0bc6ad68f003", "comment": "Malware payload (Socks5Systemz)", "value": "91ca903035573a4bcd80a03e8d17a3dc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706874480, "uuid": "98bea18a-91cf-4406-854f-d3eef6448cc6", "comment": "Malware payload (Socks5Systemz)", "value": "d222377a083dcea881ddfcecf8bafc45a9f8c5cb4490014e97442ee522e1337e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706874480, "uuid": "b14c399d-7150-47c2-9e96-b7ace24c8eb1", "comment": "Malware payload (Socks5Systemz)", "value": "de72a548b88f7e7932f753b36e9511e5d66ec035", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706874480, "uuid": "dab0434b-e603-45f4-91ea-2cdc3e5870cc", "comment": "Malware payload (Socks5Systemz)", "value": "956fddffe5eeedf03a80c9802daf9bc4b88352bd331a5304b24b77bda9797ce5670f93435cf7380a3c59fa450b6aa3d0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706874480, "uuid": "a4839ca8-21a0-4ef5-bce1-045f848757c6", "value": "T1B7863392A8B5B315F0BA7F3C3758414E15AA4F6B1D3D50405E87A43C0FB7B938AA172E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706874480, "uuid": "dc9997d8-437d-4cbb-86e7-99996a149e64", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706874480, "uuid": "0e75f72e-b2cb-4342-91b0-7324a7565528", "value": "196608:ZZyIqSuvQ3VbjZbIPtP1OBHCb546esC+f:gv6HeYib5lesVf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706874480, "uuid": "0fb3dbdb-7b66-4c5a-bf3a-3ce2aa2f6475", "value": 7841517, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706874480, "uuid": "890431da-603b-4f84-8793-06545244e490", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706874480, "uuid": "4db4fbc0-b122-416d-af9a-da59c66c6e09", "value": "91ca903035573a4bcd80a03e8d17a3dc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aff66d25-c172-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706840881, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706840881, "uuid": "d4add457-5ca0-4eb0-a39d-79bd69314179", "comment": "Malware payload", "value": "907f3c3850709f23593c55021e2a947d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706840881, "uuid": "f5a9b686-c80e-4461-afb7-390764e0d60e", "comment": "Malware payload", "value": "d231e01cf9101542a86bbbf82ded4550c57ffc345ab46f9481cf8ec23a06e621", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706840881, "uuid": "9d1cf7cf-6a8d-458e-a332-03c01801cb48", "comment": "Malware payload", "value": "8ef288eccc3e0f9d3e8f558eaff1d694f5325646", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706840881, "uuid": "9440d18a-bd63-4d45-973f-8ab7932fb78f", "comment": "Malware payload", "value": "5f975a84bed601f18547505dc1c378ec73a2ae192ce81047386126dbbb50ca242ad5eaa5b83c6ad28dff258a59ec40a6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706840881, "uuid": "91cada25-91cc-4a0f-b9c5-9632d8ad2b44", "value": "T151E63398D1849DE0EDF1553B89E54447EA3AF9321330CACB92B5B1931E273D44A7EFA0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706840881, "uuid": "3bf07898-d8f2-44f6-8de9-aebdde7f110f", "value": "20d446c1cb128febd23deb17efb67cf6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706840881, "uuid": "026520c0-9da2-4cbb-bfcc-4a2be3e1d49c", "value": "393216:yJRiIE7YoH8R4ukW+eGQRN9jo7BGcGhx3/:x7rIRkW+e5RN9Mq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706840881, "uuid": "88e7ca67-6c9e-4cf7-8363-04486a998523", "value": 14654479, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706840881, "uuid": "21948a85-3e3c-4b6d-a432-fa8f9d7faff6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706840881, "uuid": "13c6065f-771a-4057-9973-1f8a12baaaf3", "value": "SecuriteInfo.com.Win64.Evo-gen.8168.21888", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e30d9da1-c1b3-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1706868884, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706868884, "uuid": "febec303-e5cb-4a8e-a0d0-25ec992bfa8b", "comment": "Malware payload (Mirai)", "value": "ec50e2f8100c5cfab3974de5d1b358df", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706868884, "uuid": "0feb1fbf-ca36-4666-b1be-09a4bf2f76a7", "comment": "Malware payload (Mirai)", "value": "d3249bae69ea8c05506384a1f3201bda4fe187573d78c526c79e8ef960e30522", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706868884, "uuid": "c3d49502-43d4-489f-8f18-d96f4fce7e2d", "comment": "Malware payload (Mirai)", "value": "db928c33390a5ec3c5de5068ed94d7a1ff670642", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706868884, "uuid": "5873d62e-dc00-4fa4-bc83-da097b54ea1f", "comment": "Malware payload (Mirai)", "value": "be35d6363fef2925ef36760daae50a7665d811773e00e10f41b439effb38a52cdf83c4877eef1d244a9171f5636c50ac", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706868884, "uuid": "bc26d92c-f324-423f-8da5-d987ce77e4e9", "value": "T1B2231795BD809662C5E415B7FA5F428D7B2203F8E2DE73129D159B303BDBCA90EBB401", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706868884, "uuid": "e3b74120-396d-4cba-a6a0-566de28166fc", "value": "768:V6cX6+NXdX+6byMzPEbkPH6b9Hjlbj2cVbMm2Ebqv2qGNzKXRjUAfvYemMabRNOS:EcX64VHymikPg9HFj24MmxqvLThz9abu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706868884, "uuid": "0ea07aef-8937-43da-9f3e-bed131be2eea", "value": 47768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706868884, "uuid": "7d0be217-200c-48a0-a458-6a015cca5070", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706868884, "uuid": "33daf6be-0b75-495b-a47d-e88968e618c8", "value": "ec50e2f8100c5cfab3974de5d1b358df", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf319bbe-c197-11ee-b7ea-42010a9c0006", "comment": "Malware payload (GuLoader)", "timestamp": 1706856825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706856825, "uuid": "0365c971-26b1-435e-b894-e9ac1a4a4a21", "comment": "Malware payload (GuLoader)", "value": "6605a4c8edc56c1694e1cce0f322ad0a", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706856825, "uuid": "8b45f2a2-4012-4449-aad3-873547749472", "comment": "Malware payload (GuLoader)", "value": "d33fe67b9631a10828dbdb499ab005af157d6d84334bbdeaa1c45e59201a93c5", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706856825, "uuid": "138aed44-4ec0-408e-852e-9023f0f3392c", "comment": "Malware payload (GuLoader)", "value": "a39459dc818720ae939d6f26559181b24d93d82f", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706856825, "uuid": "2892fe70-9e22-4d15-9838-45a72bb9bcc2", "comment": "Malware payload (GuLoader)", "value": "72dd4d536ad102367df32edc3c0a861fe8ab234c8541c4d09e84c14d5ba39bdadcb607e7e6a122b0ab3c3e8d5f897704", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706856825, "uuid": "2bc3997e-8180-43ba-bf28-2d5be8df98ca", "value": "T1BF93496CFE580B660D4F3765FC852D42C5BC91212A330676FEED434DA04B49CA7BE62A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706856825, "uuid": "d2172fae-7744-4c86-90b0-1df50a8a9e5f", "value": "1536:EQpArKQospvURyTKropZ3YvvmjjXtRnyjHGReyl8os98a:ESArKQospvyqt0Ojj7yIl8oza", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706856825, "uuid": "7f51ca26-d55e-4a6c-bbb5-ef46f0045d8e", "value": 91654, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706856825, "uuid": "c41040e7-60da-4cea-ae45-39c2fe1fb2a0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706856825, "uuid": "e4e5e375-6ac6-450a-a2e4-bd226a0f2170", "value": "CUSTOMER ADVISORY - RATE RESTORATION - USEC_pdf.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3b66533-c172-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706840888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706840888, "uuid": "0e7c83b6-9e23-4c70-ba94-5d38e46f057f", "comment": "Malware payload", "value": "033f0bceed6769ef892c5c16eba1138d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706840888, "uuid": "c7832af2-9266-4327-8a47-8a07dd60eef9", "comment": "Malware payload", "value": "d373d7db42c410c0d42a42207913d379c39acdd486f731a22f295b54c2c37aec", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706840888, "uuid": "1d9e099f-0e0a-4174-840d-e923dae6f5f4", "comment": "Malware payload", "value": "30c13dd74236386de382175a7251f86736709bb6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706840888, "uuid": "4c4e353f-d7d2-439e-8a59-7a464ed8833e", "comment": "Malware payload", "value": "dbeb8e35970f7eacf77c480af6b655b24983293cdf7793fad76c55ab8ac87dbfe66e5c52fc301ee42d56526c3ff975a2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706840888, "uuid": "47cb3b4d-bbb4-489a-889b-a3ed446cdfbe", "value": "T1CAA7332B726A4513D521DD3F09C29B42C7858AFA9C11AE6BF590DB3D13083FE6439A1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706840888, "uuid": "d1b264ea-3aa6-46e4-8601-f7aef8d299b5", "value": "fd29aa5ce7bdaa52ca35555a02e4f24c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706840888, "uuid": "71312011-3fcc-4412-a1db-b3a7d21c2f41", "value": "786432:W4PXBijEG1tQNOIBquUdge1FGof5Pdgjbk8EW+eQlHNcIU:Wi0jEH+fGe1FGI5Fg3DOk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706840888, "uuid": "4210c684-f177-4e4d-a928-951cb1bb1389", "value": 43860274, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706840888, "uuid": "5e56d35b-25dd-4478-adf6-e58f53a52af0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706840888, "uuid": "8d0ce676-0032-4336-b631-beff387b5cd7", "value": "SecuriteInfo.com.Trojan.SecsyVaizor.16658.10909", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aaf7e264-c16c-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706838296, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706838296, "uuid": "724a0f4c-27a7-43c8-b8ac-cc01e71e9825", "comment": "Malware payload", "value": "b37991916b780b3ffb7174416afa3027", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706838296, "uuid": "f556633e-a963-459a-b4c1-4388bb0814a4", "comment": "Malware payload", "value": "d4534f6df9275b7de0783c5357d7bce6d0fa37f363f44ea47a203c4212a895da", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706838296, "uuid": "68d496ca-bd40-443f-a80d-1724b086e5ac", "comment": "Malware payload", "value": "fc8325f971baa87aa5b62a96e464b2a919b1bb6e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706838296, "uuid": "4822bea5-9e5a-4c36-a65a-37126937a6db", "comment": "Malware payload", "value": "6c4dae36d19fe453dcb64166095d36bea9810ec0929ca406136988bd680c587fbdf35f469ed56d88ef0128a18be6ccc0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706838296, "uuid": "80de87a8-f5f0-4d71-81f5-1cffb83f01db", "value": "T16135720BFBA611D1F5BAC139A553322AFC7638A147389BC792455A0E1B31FE4AD3E740", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706838296, "uuid": "0fb86090-78dd-47b7-9061-727c43cd2876", "value": "528fd58057d8a76273810ee182ae79f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706838296, "uuid": "94a52d62-7fd5-4c2d-97b4-9ac7754f967b", "value": "12288:2ccmGpexUNAx/TiSVYFDOoiXhMy7W60d91Dx8NF:GmGpe2NAx/OSVYtOEy7C2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706838296, "uuid": "2e164e3c-2b4b-4f3a-9767-726bdeb8ee36", "value": 1106944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706838296, "uuid": "da122021-79ec-4cc1-bed3-34e52b420460", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706838296, "uuid": "a3ca1665-bf25-4b54-a753-0623a7513d60", "value": "SecuriteInfo.com.Win64.PWSX-gen.23465.22221", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3739d908-c17a-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706844115, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706844115, "uuid": "e8d4cbfe-e8db-473d-8829-f7112a132cd0", "comment": "Malware payload", "value": "d457b2e5a57d1d0dc10d32e1f3300ddd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706844115, "uuid": "5873b5e1-20b6-4e8f-9563-3ba9982d6f69", "comment": "Malware payload", "value": "d4ac404c10af09a4fbeb91e2abcefc55fe3bb913316f019b3dbf740c6dc232d5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706844115, "uuid": "313e97ea-7d8c-440b-af9b-1104d15070a9", "comment": "Malware payload", "value": "2b622ace3049bc6d66e9cccd79dedcf54a353997", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706844115, "uuid": "3e633a93-f28f-4f4d-a547-b8411da6473c", "comment": "Malware payload", "value": "12b2c4f995ac6f0888d61856cd82ab2a9fc928c79d65b42cea08558d2afb446c32175d4a35f7d85fbbf532f0737427ba", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706844115, "uuid": "00d8e58d-d465-4f3e-a4ba-17f2e1ce7a9d", "value": "T1B2673324E2A74FBDDE2796BCA04B40D7E69BB9E303C1027223F549D58B643D0951FE29", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706844115, "uuid": "1545f693-bd44-4e9e-84aa-8588a1003660", "value": "2bf1fc659e1e270e26d98d8a21b8f037", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706844115, "uuid": "4df3ed23-479a-4679-b151-4d28b47427f2", "value": "393216:IvAtM900k3ClteCQL/IFGohs872Sa/q3TiQ8UNFUik23q9gTJwN2GEE3Wyxoab:ODkHjIF5ZySaSYUNFXk269geN2x+pGab", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706844115, "uuid": "c3e8645b-0ecb-4401-8db7-0407de1e42d1", "value": 29866288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706844115, "uuid": "d2f95b75-d0da-42fd-87ea-e6e77990eb03", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706844115, "uuid": "26a6e5ea-6730-4d6d-8902-12c04749e88e", "value": "SecuriteInfo.com.Trojan.Siggen22.5496.7508.3232", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f56390c7-c1c6-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1706877075, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706877075, "uuid": "dfb8184b-70bd-45bb-95af-dfc62a1bbd43", "comment": "Malware payload (Mirai)", "value": "b5cfd3010d4886eb2315857c86668d80", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706877075, "uuid": "cc1817e4-d1bf-475c-9fa7-54dbc85e3492", "comment": "Malware payload (Mirai)", "value": "d678257db66b887470cab67efc6355999bf43c604ea1af17292200cbbcc1837f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706877075, "uuid": "b6aebf6e-3d79-48b8-92c4-3e83e25c4920", "comment": "Malware payload (Mirai)", "value": "50a5f64babed2fa4f7b3b5693dde141248143f9c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706877075, "uuid": "d99b243b-b587-493d-89ca-5f2367d10c57", "comment": "Malware payload (Mirai)", "value": "c2a0e5b6547c12e1c5e7774103894edd1ae3891d2e100df55d3f90af823b4e586d76172405ac3b6761246c89602138f3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706877075, "uuid": "0c94b104-3d21-4243-94a6-d75dd1b5308b", "value": "T163533AC5FA43D5F1EC470970603BE7338632F9390179EB57C765AA36AC92A01E61B29C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706877075, "uuid": "71216095-217d-4d95-8826-2daedf743247", "value": "1536:svSkaB8W9C+/x5NHMrCcTSiQESaw/kyakS+nEq:GSLB/9l/xL2Cc9QXL/9Eq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706877075, "uuid": "dba2d81c-2d9e-40df-b66e-96cfefe6754a", "value": 66704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706877075, "uuid": "fd788e46-1e5d-46cf-94c1-ef613dcc6efb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706877075, "uuid": "40495f1c-eaa6-4c29-94be-3a3ced954c2a", "value": "nrx86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9358e15a-c1a5-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706862738, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706862738, "uuid": "57f7e770-6716-4d05-84a7-0191e54439e2", "comment": "Malware payload", "value": "b88444cf2c03ce4efe2a1608a379ee53", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706862738, "uuid": "b45a96c0-ee71-4522-848c-a62dbe291a12", "comment": "Malware payload", "value": "d70e292a21ebc5ca1675ca585bcae52a51aad4bcee9bbbaf44b0a2cc635b64c7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706862738, "uuid": "1771a3a2-cd39-44f6-9d4f-7446c2cd58bb", "comment": "Malware payload", "value": "68d9285ee72288656c258cf9db9c564226a48ddb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706862738, "uuid": "03a3c4bc-968a-4e5c-9a31-30dbbad93c36", "comment": "Malware payload", "value": "5b8d9cb80d7fad0abb6f97b73ad9710f928a9efd3f2dd159a68aaebbc954461d0b049b580eebce06307c17e16b095b4b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706862738, "uuid": "b125f1c8-462e-4a98-aa3e-cfedf90701c3", "value": "T14F947C9763E814E6D167C03CC547C613E6B6B0991310ABDB43A0DA7A2F23BE57E3A750", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706862738, "uuid": "49ce394e-c825-4949-86b8-a03394d46afd", "value": "1cbe23d5bc6daa93fa901ee43d967ea4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706862738, "uuid": "7ea94554-0a2a-44a5-a9a6-202e05ca33a0", "value": "12288:Zt5NpMGK6Ia5Jr4IQAvq3eSKXvVZhuwxHvh:Zt5NGGzIo3QSqOS+VZhT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706862738, "uuid": "d2d775da-6af2-4a77-b655-3f60a5a1a60c", "value": 439808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706862738, "uuid": "6f553082-affb-459a-b994-ef9c48f04db2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706862738, "uuid": "0d4434d9-c19d-4ea9-95a2-d2324e18113c", "value": "SecuriteInfo.com.Variant.Tedy.452358.22106.11215", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28edb68a-c1c7-11ee-b7ea-42010a9c0006", "comment": "Malware payload (GCleaner)", "timestamp": 1706877162, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706877162, "uuid": "4bd54b12-0458-4111-bcf8-6768c95091f8", "comment": "Malware payload (GCleaner)", "value": "c9540c9832a7ccb84ff6ec05aecff4be", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706877162, "uuid": "34bab433-01f4-4df8-93de-b98324f83787", "comment": "Malware payload (GCleaner)", "value": "d930ff3e1d83a347d05e9ccc86460e3ba2463a7284471081ff6c578ff5c6133a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706877162, "uuid": "c2f5edd9-6770-4f31-9ec0-8d26a659ecab", "comment": "Malware payload (GCleaner)", "value": "774f29fb11f00dc51e9e84f5fc5a91fd10f0bddd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706877162, "uuid": "a2246fb6-b220-49e0-a2a0-cfdafa01c9c2", "comment": "Malware payload (GCleaner)", "value": "5a0e1b09a8d0163de5b230d8c27254e911504834812b49c94590c97b56863bc02caa5ee945c9af0cbcb6717302a9019a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706877162, "uuid": "340c83c1-007e-450b-8b35-7073904c270d", "value": "T1A244CF21BAE2C4B9DAB745704871CFE01EBFB87655B1858B33A82B6F6D703D14B52312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706877162, "uuid": "1f66bc74-185e-455a-a27c-6acb9eee5d66", "value": "54fb425b0b9e8729b2c00c5001132758", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706877162, "uuid": "dbd068cf-9f17-4f00-99aa-c0edee0bff8a", "value": "3072:JU//LJWGhh+7xoUXdxNVqeGVh+QIcjMDBxT6/13A+fqzLX7u5IhACDnTG:Jw/L/+7xoUXmeGH+NFBxT6vqzjxqEn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706877162, "uuid": "3be3f572-ebe7-484a-a413-765d9df49fdd", "value": 262144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706877162, "uuid": "529028e7-ad66-4cf1-b26f-960d3a057e1c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706877162, "uuid": "e18f8dde-5954-42cf-acea-35e562b0e166", "value": "c9540c9832a7ccb84ff6ec05aecff4be", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c75cb332-c1ad-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1706866261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706866261, "uuid": "cc887307-000c-4035-a514-8ff8bd2d3429", "comment": "Malware payload (Mirai)", "value": "b2c9a9f64440e7afc2b821dcac7ec95b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706866261, "uuid": "bd84246c-90b9-4538-af7b-0159c2545467", "comment": "Malware payload (Mirai)", "value": "d9b6ce81334bcfa15c441e8b3bbe7e3084c30af0d01c8d789be789512ed59b4d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706866261, "uuid": "5aa1e2f0-3936-4b63-9187-96b9150cc447", "comment": "Malware payload (Mirai)", "value": "7430d5a8824e0d4f6821947d2d9f19ed33cd30c6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706866261, "uuid": "c8bcd0b5-e4ad-46df-9542-274ec63c3075", "comment": "Malware payload (Mirai)", "value": "6cbe4c09aa8842b7294f823728295da743b6446aac35678c840dcf590a181321208c7bb40c53d540d6bf0ade70d6548e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706866261, "uuid": "c6713133-a171-46bc-b45f-1361ecef16e6", "value": "T11263F756B8918B11C9D513BAFE2E118D331353B8D2DFB212DE106F60778A96F0E7B852", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706866261, "uuid": "ef075f19-9122-4242-a4ca-436070037b93", "value": "1536:+hnyzZgiMAxBQAbfTKSNtwViHAiczKr8+ZVacNBD/qrMwAULQIuii0ZKZWi:1d7IA7TKyeihczKjVNNBD/iG0ZKZWi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706866261, "uuid": "b43727a7-0a96-4a73-897b-8b48a12b54bf", "value": 70928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706866261, "uuid": "6598bd55-7482-46a7-8f96-82ec1392ae36", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706866261, "uuid": "0a2b1014-057a-4ae9-8869-2557d991c4ee", "value": "b2c9a9f64440e7afc2b821dcac7ec95b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "467c8359-c1f0-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RiseProStealer)", "timestamp": 1706894821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706894821, "uuid": "524cb2a9-5ee1-4bb1-9124-5e59d0bac0cd", "comment": "Malware payload (RiseProStealer)", "value": "d828568e55f36c8c3c6f242700ce8a0c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706894821, "uuid": "0469732f-2c54-4bf3-afff-d632a86a8f58", "comment": "Malware payload (RiseProStealer)", "value": "d9cf5100cd68da3dd5737151dbc251fcf32e051744f55d370da0e995aa19fdd1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706894821, "uuid": "f8f05c4c-64cd-4ea6-b6b1-1616c3b93ec7", "comment": "Malware payload (RiseProStealer)", "value": "115eb1463c9d3b63765151bc207369399f66df52", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706894821, "uuid": "b37bd967-f9a6-49e4-82c3-3cd297726c19", "comment": "Malware payload (RiseProStealer)", "value": "0071131ad7f4306a28fb4bd5a79a32516f511301229114cef78f459c8a32186fa121df9af3d481d413e65f6085efe4eb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706894821, "uuid": "af45f59f-2655-434f-969f-e084aeec6cc2", "value": "T187B533F7AE3A3C69D2A7033AD6451CB03587DC83A12789986A78F0A1E7FD6F0D525D04", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706894821, "uuid": "3e4f03e3-72e7-4b2e-acca-ed475a89e25a", "value": "baa93d47220682c04d92f7797d9224ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706894821, "uuid": "dfcc343d-fd95-4ebb-8c68-35963cb8c771", "value": "49152:ORQ/8uBI82rQH7+CmoCmsC/x9xZGRvub4Swj0mh1q4ectwh1G/7CMRafS:lla8fH7+/xml/x9iuM0Sq4eCwb42", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706894821, "uuid": "331a2eb7-d2c2-44d8-b203-78eec10f4066", "value": 2308096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706894821, "uuid": "d4946689-be2c-4a98-8049-71ce9efa085b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706894821, "uuid": "a4a57a5c-8072-411b-9e9d-d0f80be15969", "value": "SecuriteInfo.com.Win32.TrojanX-gen.29490.28356", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9741b364-c1ad-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706866180, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706866180, "uuid": "35158213-b3d4-4d57-b147-81f747e8cf16", "comment": "Malware payload", "value": "fec81a85a74d4075e1c0880d97e096be", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706866180, "uuid": "2a2307b3-e56b-472b-862d-f91d50f9c0ff", "comment": "Malware payload", "value": "db0c353f9191d257aa3d85abd8239367afd493dca2c484e42a94ad1c14bbcca7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706866180, "uuid": "f6611795-23ce-424b-966b-cbd7b64ecb28", "comment": "Malware payload", "value": "ffdfcb0c6a607f3ee4d43c2b43b84d88250ba4f6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706866180, "uuid": "29323f44-393c-4791-863c-c6fb2ba0a98f", "comment": "Malware payload", "value": "55e1a11af36637f59ce3f33a6c2c82caab533c49643f2cbc0fb46b90504b959b3d95c3da80c36f3ad9eafee451a6abf3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706866180, "uuid": "7705f75b-5cc4-4495-9427-9fec798d6f36", "value": "T1FBE4E0057698862BE3E0077B14130570C7B1BDA8FA72E79AFEE43EE9357E650C811297", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706866180, "uuid": "e2d38a13-a68d-4485-a850-fa718872b842", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706866180, "uuid": "ee784149-86f3-4c8d-9d2e-681ce3e9919b", "value": "12288:2R64us9EYvdYH2NQepvct2RjZ091jJ1NnLs5h1/g0XODz:/4ush1YWNQedctOjZQLs5fUDz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706866180, "uuid": "d6e3ec72-190a-4c79-a9a9-10bbb41ff32e", "value": 685568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706866180, "uuid": "81ea5d1f-1a96-435d-ab1d-236b45518c94", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706866180, "uuid": "ed960d1d-01e9-49ed-bb72-bbb057376ca3", "value": "SecuriteInfo.com.Win32.MalwareX-gen.23407.1404", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2a86292-c200-11ee-b7ea-42010a9c0006", "comment": "Malware payload (LunaLogger)", "timestamp": 1706901874, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706901874, "uuid": "e2e0f29f-5cee-40cd-9ee3-c05ead18acb1", "comment": "Malware payload (LunaLogger)", "value": "f2ed2212be02acf80254dafe0235dba2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LunaLogger", "colour": "#B0DCF9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706901874, "uuid": "2c32691c-5847-4568-b148-b5fb1c3120c7", "comment": "Malware payload (LunaLogger)", "value": "db1e0e5715349442261ca944656fb938a84948a0b4c4bc637459896a6eb53211", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LunaLogger", "colour": "#B0DCF9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706901874, "uuid": "19a73827-6b34-422c-8d92-49c9f0235565", "comment": "Malware payload (LunaLogger)", "value": "e68fb64c40d558ba0ca39c55e1fe171aed5ebaad", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LunaLogger", "colour": "#B0DCF9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706901874, "uuid": "d123ff47-581d-42ad-ae16-b85997079473", "comment": "Malware payload (LunaLogger)", "value": "c7c76cd7785369615d7aac81e1a28d3bbffa569ea5d3864e9deee4264922942b22b93e8c3b23b44ea79e0e6d2503f8da", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LunaLogger", "colour": "#B0DCF9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706901874, "uuid": "6d9fe053-8cd7-446b-8b2b-5272991b5dfd", "value": "T1B90733B06A9050E1E8F9913E840F850982B5FE5127B8E6CF937C92795EA72154C3FFB4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706901874, "uuid": "75191361-79b1-4a4e-8310-d23a9ed2dfa5", "value": "1af6c885af093afc55142c2f1761dbe8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706901874, "uuid": "0f9197c5-935e-4d2a-b3c4-b1934da2526f", "value": "393216:Lh9SBLFGQZXGWoKhATe4FqyRgs3lghXBDzFT0:t9eFGQHh+qTGW1Zz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706901874, "uuid": "dfea07f2-aed2-4064-b65e-cd1a2d12fcc8", "value": 17363447, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706901874, "uuid": "4cb9a9c6-b14b-46ba-aeac-12342e7b4ca7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706901874, "uuid": "ee55e404-155d-464e-863f-38cf880cae7a", "value": "SecuriteInfo.com.FileRepMalware.29948.26447", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "984e92fb-c19e-11ee-b7ea-42010a9c0006", "comment": "Malware payload (PureLogStealer)", "timestamp": 1706859739, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706859739, "uuid": "43a8c887-cfee-4a47-a2c6-8550012b7ccd", "comment": "Malware payload (PureLogStealer)", "value": "9d37eeb07d1aba8bad47f2a3896e0bd9", "object_relation": "md5", "Tag": [ { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706859739, "uuid": "e935b206-1bb2-407a-9440-583e59767c91", "comment": "Malware payload (PureLogStealer)", "value": "db69c622ecbef54b431e402867f090ab7fcf296084cc616470dec464bf999e61", "object_relation": "sha256", "Tag": [ { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706859739, "uuid": "c1fcbfa5-ea4d-4462-b5dd-56a4b8b95cb2", "comment": "Malware payload (PureLogStealer)", "value": "070de2a9453896ffa3d5adb64a541c620b6054d4", "object_relation": "sha1", "Tag": [ { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706859739, "uuid": "d27ab336-4e08-4150-bed4-0294b080ce26", "comment": "Malware payload (PureLogStealer)", "value": "9602c5f2793265df2172ae988bd72336a86e2c437ad00a1b28405f970c32bf038c21c8bf7db83f12beb7c2a1397e32ec", "object_relation": "sha3-384", "Tag": [ { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706859739, "uuid": "cb8aac94-8ecf-4f13-9a62-c417c6d425ca", "value": "T15C8533F6E771A667DF438A3220F14B95C512634519580A10DF04A4733EEF3A4BBFB962", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706859739, "uuid": "64c04c87-1cf6-4f8a-b8a8-213a6a19ea56", "value": "49152:gX1akK3cTgD9/qO9HWHC/2wkn/NT7bi5Gs:glansgV9OCuh1P2Ys", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706859739, "uuid": "aa391fce-d677-4b9f-bc02-0c96ff4c21f1", "value": 1748339, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706859739, "uuid": "cef2e9a9-9c24-4333-9066-c04486797a60", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706859739, "uuid": "a7868f52-fcef-4dd9-88ad-de0d88de1240", "value": "kuzy9n.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20bec099-c1d5-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706883161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706883161, "uuid": "60e26962-c165-4506-aa0e-85b1b10d4a51", "comment": "Malware payload", "value": "353a3b4d65ce9168817e09d5090b2afa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706883161, "uuid": "96448b76-d8ac-424e-a7c4-7bda1d5a13bd", "comment": "Malware payload", "value": "db6db1a60def0b16630069bcb9d354a963a6758966dd08dd54c07b8509ddd5d1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706883161, "uuid": "b3296c8a-8ffa-4ec2-9013-494984295fd2", "comment": "Malware payload", "value": "01ac9441b1ef28c6da0194de968cc2c2190a5cbb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706883161, "uuid": "a2f89fa4-a756-4281-ae8f-c77990630550", "comment": "Malware payload", "value": "756beb458c20f489a8757ad1c27fde448da32cb9733f4fc0cc7f0e7d6d5d6c2567143da3251736ce26a34fbdc9001ce5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706883161, "uuid": "4939518a-d16a-4d24-8a38-de34f015a6fd", "value": "T10EF5BE43A384903EF6EA0D3A4CB6E3951C7EA2711912DC5F5BE3784C8E38580DD7A766", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706883161, "uuid": "cf52cca7-6c8f-449d-8797-4fba9e92b33e", "value": "bfe5cf47adea756d5b144adf6d3b3603", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706883161, "uuid": "ccc0c0ce-324a-4b95-bb8b-5f7de1b17b0d", "value": "49152:iu5voq9yqVHncEylouiXCvkHDHxj9fc7wwIxHuAkXX9dSq:iu5vPVHnfyNiXCvKDHxj90VVXX9dL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706883161, "uuid": "da236278-4c8d-4a06-9114-a701d025fc9f", "value": 3429888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706883161, "uuid": "5255b691-aa98-411d-b5ed-5029835007fa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706883161, "uuid": "a09f9840-edc8-4ff4-85c9-008dad3d1709", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be36022d-c1b3-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1706868822, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706868822, "uuid": "17033836-c9d7-4802-b64f-b3d71a3c114e", "comment": "Malware payload (Mirai)", "value": "000ca377998fa85dfecf7467d23d278d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706868822, "uuid": "2054f5c8-ed46-4676-b4b0-470663a4fca9", "comment": "Malware payload (Mirai)", "value": "db803708dd9c67e39ec1c0242194f74d45d92e0f0e7cfac94cea1b770902a836", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706868822, "uuid": "a9371a50-84a5-4d28-ab88-89cb150a1bcb", "comment": "Malware payload (Mirai)", "value": "e5820eed64a608bd3d6fff6aff6d804913ed6192", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706868822, "uuid": "ce0906a7-50f6-47e6-9903-50b9b4c14f8b", "comment": "Malware payload (Mirai)", "value": "ff94f43d3f84a818e1a9e010d694ade9ec83099eb679b0bc8505fed165388b4173be49ccbf936ba53ad4a81bb72a4dfd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706868822, "uuid": "f4523eb2-5bb6-4129-ba2a-96fe723afe4d", "value": "T121136BA28CA41E14E185C535BC360F32F357A910654B6FBF16A7833D8887DADF2473A9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706868822, "uuid": "df74b5a7-ad1d-47af-833a-1eb747cc6cc3", "value": "768:svHLLck6cB6/ALceV/36cDKyAiC1kVK35S5aUoko++eCdgNJJfiwbuqI:svH8YM/hU/lVBK35S0DkoeCdRwSq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706868822, "uuid": "0df135d2-2bfb-4f8f-a3da-65b9f149ce09", "value": 42476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706868822, "uuid": "1efd46ff-7ac6-4240-9c28-b6be5b31912b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706868822, "uuid": "ca32cc5e-814f-4d4a-ba07-48ca8231c7e8", "value": "000ca377998fa85dfecf7467d23d278d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "971539a2-c202-11ee-b7ea-42010a9c0006", "comment": "Malware payload (DarkGate)", "timestamp": 1706902687, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706902687, "uuid": "5c1978be-62f1-4072-b5ea-a6a1668bc76b", "comment": "Malware payload (DarkGate)", "value": "6286895f855df2e0577a8de4c7d083bd", "object_relation": "md5", "Tag": [ { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706902687, "uuid": "6ac1a2b2-9e04-41d0-b314-72cca8eb7c5a", "comment": "Malware payload (DarkGate)", "value": "dd02646e2bfae250696acb1f911f8feac56e3223c11aa26ebf2e77700c0477f4", "object_relation": "sha256", "Tag": [ { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706902687, "uuid": "c7ac3893-85d0-4871-a858-d417263d378c", "comment": "Malware payload (DarkGate)", "value": "b963d63927e491e9297ca56d737dda5b24aeb929", "object_relation": "sha1", "Tag": [ { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706902687, "uuid": "c60c3762-ebba-4097-87aa-c7f5421113bd", "comment": "Malware payload (DarkGate)", "value": "484399dd86fa53f4ff9e97f01a1dd4c0c056ebf8d28d901a4d36d8f406ccb7f82543b9461c455bb069628e1b721e632f", "object_relation": "sha3-384", "Tag": [ { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706902687, "uuid": "76b02561-337d-4811-a33b-3a9334032fc5", "value": "T191418734DED40233F6B28A72C466E311C83BB843EA1DCE1D008352C410732A3A8A6E6F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706902687, "uuid": "ace46126-3f97-464e-b71f-34aec63d354f", "value": "24:8AY/ByKnC+/lmUngjppspHvkSwVdd79dsrab/:8xPnigkVdJ9Aab", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706902687, "uuid": "8d0dfb69-2b17-498c-b558-a79bd41ff681", "value": 1998, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706902687, "uuid": "12566d10-529c-4991-a2f6-f82d32f5635d", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706902687, "uuid": "a2d3059a-65f3-4776-aefa-b7d2a71c4580", "value": "TaxForm.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4a7f1be-c17e-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706846070, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706846070, "uuid": "d5b4eedf-7188-4f47-82f6-f3e807856489", "comment": "Malware payload", "value": "d26d3b4554b749e461a36bdcfd57a7b4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706846070, "uuid": "36e445e4-fd0a-4678-88d8-a7d8fe0dc4b0", "comment": "Malware payload", "value": "de3ad9a4568fe400c8f1251f5bfad982605edbe99df55c89554b7f3c76b9a137", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706846070, "uuid": "62b55c89-2aad-4a28-b250-332ca62dbf70", "comment": "Malware payload", "value": "4bc83e28a6655a0907e696214c17315c40faa920", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706846070, "uuid": "a84abb90-075a-4b05-ad72-26eb6df616a3", "comment": "Malware payload", "value": "a17e0671f4c8b384b8c5297414cbb87e862b9ffaab1ae1b46a465f4a1461ca0704558cac4beafea7439a8cfccbf6dc16", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706846070, "uuid": "fc8ac319-269c-43c1-b22e-f70933e617ba", "value": "T1D433545A2E218FEDF76C8B3447B34E22A79823D626E1C6C4D25DD9001EB034D645FBA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706846070, "uuid": "8e2b41e4-9a58-40af-b5a0-dd452d205786", "value": "768:mR9UQ3S8O8hXuHuHk6Nt2bm0Vw1BgvkHMS7htAKgWnhop+rz:mR9USNheHX6O2d9g/p+n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706846070, "uuid": "4ab51f20-cc83-4cd4-8962-4ba24974236c", "value": 51560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706846070, "uuid": "81c5db8a-657e-4e0a-84a8-d8a6ea408360", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706846070, "uuid": "0829485d-2451-4eba-87ba-f91244b02e01", "value": "d26d3b4554b749e461a36bdcfd57a7b4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18500dc1-c1a2-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1706861243, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706861243, "uuid": "0ce4a27e-58f9-441f-8c10-ece366db187d", "comment": "Malware payload (RemcosRAT)", "value": "c8b5bcc79120a06f16b69bcef71324ac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706861243, "uuid": "a82766fc-b78f-494b-a2dd-c67da88744e9", "comment": "Malware payload (RemcosRAT)", "value": "de4f901137b60be1b2c0155595baa77837d7325736cc1d4910536cd32cf58252", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706861243, "uuid": "941c8b68-95a3-4e56-ae74-f9873b671ced", "comment": "Malware payload (RemcosRAT)", "value": "75acf6d77851efc30a181ad9a78334b7c272705a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706861243, "uuid": "eade69dd-7a1e-47ba-9e01-019e8364de1b", "comment": "Malware payload (RemcosRAT)", "value": "73717723250d0a789b994c35c4efcfbb03f27d4455500244422068fb1e5c866e681e9cfb47c5ebedc1bcd5c7cd43594e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706861243, "uuid": "5c122da6-ffe4-45ba-b3be-3b1a71c58388", "value": "T1293412A42F67EC94F2C090F45402E1F072EA2C761AA7664D07E4BF57BC7E550BA9A063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706861243, "uuid": "53c9b076-df6d-47b1-aaad-cd0df2b84efc", "value": "bc4f8e98d1041d53dd63bfb91ed10d0a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706861243, "uuid": "3b4615d7-ec27-4f7d-b10f-a0b52c13c668", "value": "6144:tmvl3n8iOiB4RBucKa3h80tK2gBWvADGGw6j1:8vlX8i8RB5JvADGGnj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706861243, "uuid": "acf4c474-b01c-4718-aa03-29f0d928c28a", "value": 239104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706861243, "uuid": "03fbabd4-d582-4aed-9227-cb1056b394c2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706861243, "uuid": "22d977e4-876e-4b93-9cff-e5ddd2046218", "value": "bTud.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "838c1784-c1c9-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1706878173, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706878173, "uuid": "958fe603-a475-484c-9b53-d9f864c52ddd", "comment": "Malware payload (AgentTesla)", "value": "4c075cbb62caf75a3fb2b18b10671a28", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706878173, "uuid": "2ebb1a39-86d7-4ed4-be88-a9094c8f3661", "comment": "Malware payload (AgentTesla)", "value": "defde5037209cf9b13e679b49390070f0a855802a4f20f30302efcffb67b352c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706878173, "uuid": "2709a6c5-3364-4224-b3c1-2c92e966023e", "comment": "Malware payload (AgentTesla)", "value": "739c7ef865879be28eb108b4e293483253bae54a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706878173, "uuid": "82d5d375-6634-4afb-9501-4bc6b31078e5", "comment": "Malware payload (AgentTesla)", "value": "9af82c9ea1973833b228b83447ef06f11236850c0dbbd4dcaefe98fa120647d073b76923a6ac599b0ae31d78607b5e75", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706878173, "uuid": "9cc2eb3a-76fc-41d7-9ba6-999107f36f7c", "value": "T12DB3F46DD34B02598F624337AB1B1E5142BDBB6EF38552B1302C537933EAC39A1252BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706878173, "uuid": "38da4e9e-7a34-4e60-ba43-d76f1b798842", "value": "768:PwAbZSibMX9gRWjtwAbZSibMX9gRWjtwAbZSibMX9gRWjIdRw6ris3N+aaI9uYKX:PwAlRkwAlRkwAlR1dRV305vYIaPLkk+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706878173, "uuid": "ef0b4eb5-e2ae-438a-ba11-88845a78254c", "value": 116972, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706878173, "uuid": "a9ad2d60-4442-4ae3-b24b-3b3b43f2f82c", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706878173, "uuid": "54b2da1b-0543-40c9-9983-8259c3fb8ee4", "value": "PI00232.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b680bc3c-c184-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706848623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706848623, "uuid": "b5ee27c1-7a2d-42b2-ab5c-bf0cea8dde87", "comment": "Malware payload", "value": "25cd2912ec14cd1d22ae10ebed084559", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706848623, "uuid": "4fb29d56-51db-464d-b635-9c352af2e09f", "comment": "Malware payload", "value": "dff05f78ac1053b1c5cae315947fba2a01a65ca7d8622b9b171cb97e8e1f38a4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706848623, "uuid": "582fc6e9-992a-4417-8988-a61631e8ad9c", "comment": "Malware payload", "value": "71715e897e354517febbaab5a4c34a1d75a21058", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706848623, "uuid": "8dd82ec1-21c5-41a8-9381-f5d763cb91de", "comment": "Malware payload", "value": "4a3ffed5be90d4f401cc2337e3145668375fd2816cfa6fb24d1dea63b0119a181ab88d5d44c8dc72f2858f8aa59e6839", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706848623, "uuid": "4c42cb82-bb62-4156-955d-899243261f43", "value": "T15A43961A6E318FEDF76D873447B74E219758338626E1C684D19CEE001F7028D685FBA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706848623, "uuid": "5d052b7b-7cf1-4f7f-8585-ec8565e2ca47", "value": "1536:g9P2p6PLmDWWyLWXHKdNdhU8B65tyWrl2elbESrlBeZeZi:gTLFVwHKdNdhU8B65tyWrYelbESvekZi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706848623, "uuid": "26d3ef36-07e7-45b8-b5da-7694fe8b3fc2", "value": 59772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706848623, "uuid": "1ca4be44-c3b6-4a8d-8084-6f0f85b4ee02", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706848623, "uuid": "078ba5ba-73cd-4daa-a10f-3815884891bf", "value": "25cd2912ec14cd1d22ae10ebed084559", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca2a8078-c1b3-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1706868843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706868843, "uuid": "c6d23bf6-4e3f-44ff-8a36-b7ef43b5caae", "comment": "Malware payload (Mirai)", "value": "342e6e5e61d15c7b81331ddf87dec2e0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706868843, "uuid": "4bbc8469-1973-4923-89cc-51c3e77a98ba", "comment": "Malware payload (Mirai)", "value": "e0457986fd04d1dd196e2cf10594ed48da952164fb2a46f065b1ca2aea545538", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706868843, "uuid": "ab038a71-2d31-4888-8401-426ceae35fad", "comment": "Malware payload (Mirai)", "value": "a48197c72147e671adfdbccd541403c2f32f5def", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706868843, "uuid": "e55f6e1e-eb32-4b20-802f-91dfcae65e04", "comment": "Malware payload (Mirai)", "value": "8d58230008132317c029e5375fad44b22d0cc1e5a08d5fb20a63b9f3b193e6ee3d93b5c4a1714cd915a0d20fe378bb0e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706868843, "uuid": "c517cc23-cab6-41ae-a5d3-552c8bf2df09", "value": "T1C7C32A56E6404B13C0D6177ABAEF42453323A7A4A3DB730695285FB43F86B9F0E63906", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706868843, "uuid": "014692fd-92c4-486f-badb-d932891db637", "value": "1536:w0nPFr4yXKG4XLhWNW1nSwhyTxJNlQGi7CxpQIn6DDKknKGDzw/9P1n9g85S1l3z:D1cQNW1nSwhRTCxWI4DZnKWM/9xaWmj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706868843, "uuid": "44a3ec97-686e-4f97-a496-bf0342e67d7b", "value": 124212, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706868843, "uuid": "c833e9f7-43f8-47b6-bb7b-cecd5b36384b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706868843, "uuid": "c716c826-5e2a-4188-966b-b674abe1855e", "value": "342e6e5e61d15c7b81331ddf87dec2e0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "083b53e8-c1f0-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Stealc)", "timestamp": 1706894716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706894716, "uuid": "e1e4cc52-6942-4e04-aca1-81a0231e04b7", "comment": "Malware payload (Stealc)", "value": "7e20aa23f67127f4cb8068045efe69b9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706894716, "uuid": "709949d3-0d6d-4bb2-a942-33e6f5b878a0", "comment": "Malware payload (Stealc)", "value": "e1fa577ef8003809c87669e2577463d7c1b1873e0b6300524b1f782687969d83", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706894716, "uuid": "ea18d19a-d667-4e72-96e8-938ac9339d56", "comment": "Malware payload (Stealc)", "value": "05a2cf7984fde6ba5776f8b4b4b1e1e25d94bfc1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706894716, "uuid": "741fcf7f-40dc-4f47-9e6b-3d17d62b7f80", "comment": "Malware payload (Stealc)", "value": "739a6283d56fdf4a750a0e1ac19eb274b4f3665426aa707eec7c769fbe68bb7adef0670c422900acf9b7de2387208f0b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706894716, "uuid": "1b67ba3d-669b-4ab3-b576-88390b16fa4b", "value": "T116041A30F17FADB2C5DF24BD1C18D2927596209B1BA7C2E325C1E6EE38E06D25931693", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706894716, "uuid": "32fbf778-08f9-4ae8-b268-68e90a2674a7", "value": "bcaada7db1c3b7a0077de29a4546c424", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706894716, "uuid": "48fedea4-6239-44bc-a5b3-86a718a7204f", "value": "3072:fbW/nQcMu/kayTftJ+hTioWDpuOtlYGu7c:fbWH/ka6M4T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706894716, "uuid": "e33c652d-67a9-4285-8eb8-1a50c78536dd", "value": 177480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706894716, "uuid": "51ddbb60-73d4-42b5-8c13-557673cc1895", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706894716, "uuid": "9c6499b9-e803-444b-90a4-bd219c40d0f8", "value": "7e20aa23f67127f4cb8068045efe69b9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04fa851b-c16b-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706837588, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706837588, "uuid": "90172344-d6c5-4632-948b-4baf9990f2ef", "comment": "Malware payload", "value": "601d70c1b36e380b188b73294a2801a7", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706837588, "uuid": "1ab715fb-4a25-4c39-ae84-c14753fbca2d", "comment": "Malware payload", "value": "e4aaa3a33b3da58fdb3d183f2f618f94d9c9f8457d27f91960b05b12d0e2eb1e", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706837588, "uuid": "d6ea717d-dd63-4896-9f61-82f5d2cc83f6", "comment": "Malware payload", "value": "4b3d5be2c134e6a13751e08f7fc5ec2c2e671bd6", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706837588, "uuid": "17033ebb-2510-4a1e-96bf-d785ffc6753c", "comment": "Malware payload", "value": "9472b14228ba17d24b59c087ce321597f07f66d55da33840ed2398073148bb0d3a64dd97c114a18373c1f0f971519350", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706837588, "uuid": "b4afef57-1c58-4325-aa22-be9d0f302c96", "value": "T1EBC30235ED69D920E89341F90CA025F6FDF2C512F7107109B959FA6ACBD40E7C2E988E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706837588, "uuid": "525275e6-82e5-4c50-b7df-4dbda8e86ea6", "value": "3072:AUbuytRcdWjZ0IL2+D6SZAkMiLJl2nsnRMrJr+BYEUAX:AUqybjzRzADiFksMrcBYfAX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706837588, "uuid": "485fd1f0-380f-41b7-b3dc-a89247927514", "value": 119791, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706837588, "uuid": "aeecdde3-69be-4a68-abad-96bd28641ef9", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706837588, "uuid": "7c78e50b-ee26-4223-a5d4-9c281a7b6312", "value": "B5578027.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40e30362-c1ba-11ee-b7ea-42010a9c0006", "comment": "Malware payload (GCleaner)", "timestamp": 1706871619, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706871619, "uuid": "35f62d6e-6d32-4c32-a125-50cf820e7a9b", "comment": "Malware payload (GCleaner)", "value": "90583bd16d5de0262b30234953d65dea", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706871619, "uuid": "a99b2fc2-f7fe-4ed2-a2b5-34e31d6e1112", "comment": "Malware payload (GCleaner)", "value": "e508daad87b3c7b9651cc3d05a951c6acd75869ef05b69f8f2b3d4db7b6047a3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706871619, "uuid": "b297fcad-89aa-426d-8595-0794a0ca4a9f", "comment": "Malware payload (GCleaner)", "value": "11a4087c99edbfdb02b9b10cbb8243aad2a23357", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706871619, "uuid": "15560c1f-d73e-447d-84dc-a01a0ba259e3", "comment": "Malware payload (GCleaner)", "value": "e3caf21650de7dc21cb059e2e2de7b17d55d70c8f689f29f7fac211cd45584f2e51c100825102c9946fb8558576fe29b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706871619, "uuid": "b95dbf46-4696-4b94-9369-4227ff05af08", "value": "T15E44D021B4A1C472DAB745B45870EFF05E7FBC765661819B23A8FB2F2C702D14A66323", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706871619, "uuid": "831705c4-d3ab-403e-8eaa-3723746f678a", "value": "54fb425b0b9e8729b2c00c5001132758", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706871619, "uuid": "845714d8-3e50-4895-8372-a40dc6bc2fb8", "value": "3072:nk//LJWGhh+7XN4MQN3uK/vQ1cZsPFz+KSNkeGYbzor8CnXX7H5IhQCmYTG:nA/L/+794+K/vQ2GBrSNkeG5XHS2vY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706871619, "uuid": "e62a4a63-5eca-40e7-b3b9-c6039c0a48aa", "value": 262144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706871619, "uuid": "6d221434-e446-4158-bdaa-192699c63367", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706871619, "uuid": "f78875cb-d568-4f2c-92bb-cdcd914330ce", "value": "90583bd16d5de0262b30234953d65dea", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecc72fe6-c1b3-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1706868901, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706868901, "uuid": "d5b98459-251c-4323-8869-ae2d2dea2369", "comment": "Malware payload (Mirai)", "value": "f7fad1d3f20cb2f635ea4815f2bfdfb5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706868901, "uuid": "26eb1188-8cb5-45dd-ac32-058b2d79a28c", "comment": "Malware payload (Mirai)", "value": "e65f1c3cb3f128547de7888ab6f6980b864c1aa8e411d6ffb3f71267233577ab", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706868901, "uuid": "b0c4f830-9ba9-4bb8-8735-842d3f1290d9", "comment": "Malware payload (Mirai)", "value": "fc22c5a2593622efd7371bd0c8cf08a00a4cf4e1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706868901, "uuid": "84d0481b-b5b7-4cac-8676-fcab136a6cc6", "comment": "Malware payload (Mirai)", "value": "25c08edc5b4a28edf3c09532b11dd8da4283d9f1fa9ca828ad86b609d4e66e74001790f9156eaf982ef8fc98554c1321", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706868901, "uuid": "c81ff321-80ae-4a99-b077-a135a55941f1", "value": "T126334A36BA761A17C0C1A87661FB4B24B6F142CE26A8C95F7DB20D9EFF615406503EF0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706868901, "uuid": "b9f91566-f06b-4072-8f6a-22f836c19619", "value": "768:uMBvoDh1JA29DT8cjVOqhFTD7k26HFxSmpCEQzv2O+lsu95qwVV:u0vy56WwSdD7t6HFxSmpCEQ4lZTj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706868901, "uuid": "ec4896f4-8c7d-41cf-90e2-ec91e342918b", "value": 52672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706868901, "uuid": "d2c348a5-3e32-4f92-a700-a5afdf23bc09", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706868901, "uuid": "d65f88e0-48c1-4794-9d67-ab610fce2d55", "value": "f7fad1d3f20cb2f635ea4815f2bfdfb5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e202ed0e-c18b-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1706851703, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706851703, "uuid": "c1dbff11-86a6-4101-8562-d70fc31568b8", "comment": "Malware payload (Mirai)", "value": "f7eb6fe4944bcb378872cdc27d4ccdee", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706851703, "uuid": "ce60bffa-4310-4114-98fe-642d382583ed", "comment": "Malware payload (Mirai)", "value": "e6ecde9f697121a324b16e24b887f2e4c1819331bd6f1e7b6058ab30221f8e9a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706851703, "uuid": "54a90226-3066-4fe7-9db9-3eb38052b950", "comment": "Malware payload (Mirai)", "value": "73ce4cd15712c8dff7516f602e30dc5700338204", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706851703, "uuid": "5a513c9d-be79-4ff8-998e-712f8e98764d", "comment": "Malware payload (Mirai)", "value": "fa911f27ee6bbd695a3657043fff7bb78c0d1a7c771360cc54ee1ed667c0c9431f705c98f7537fedb562270c64b68875", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706851703, "uuid": "11fef7ab-45bb-4edd-922d-b5ef08bd94ba", "value": "T1BF03E784B9819A07CAD50377FA0F42CD3B256398F2DE73039D226F51279B96B0E6A506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706851703, "uuid": "e49dab22-19fd-4851-8eda-e149453b43bb", "value": "768:BRic5GwzpKBudAEhfT1gQ3cVmxwEQnh2A9INsc4:Lh1+EhZgJoaVnhhIB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706851703, "uuid": "73a9d695-89fd-4916-a513-70d22acdff4e", "value": 38112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706851703, "uuid": "ca553198-5d2c-494b-9f65-884d0b1bdc34", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706851703, "uuid": "08632fc6-d709-4b6b-b06e-3a5fb8e33ca7", "value": "f7eb6fe4944bcb378872cdc27d4ccdee", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "041a3582-c1ad-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1706865933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706865933, "uuid": "2eeb665e-8cae-46e5-a347-43791356bfbf", "comment": "Malware payload (Mirai)", "value": "ac7e59b37200701f7f4f0ce0e8171fea", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706865933, "uuid": "90fc9116-7dbf-4d8c-b8c2-ecee7ff0a100", "comment": "Malware payload (Mirai)", "value": "e7659a8325ef06147556673f7015c7ea736a0db174e088fdef0be570c21c406b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706865933, "uuid": "03323a07-8893-4da5-9bf8-cef06210a62d", "comment": "Malware payload (Mirai)", "value": "5b76b627193fed0c8ea45bfd2c0be3486378cde7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706865933, "uuid": "6247cfe0-e066-4435-87a6-3da79d8cbb0f", "comment": "Malware payload (Mirai)", "value": "58a9912bcdb864d49ece83d39b60416fd59b3f6c9dc7c9f929d6f8cb405979c5283a8322a0ef7ac152d55d3cf69690ba", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706865933, "uuid": "072e4a1d-6c8a-4f34-af9b-df2c7f8d8aa1", "value": "T1AC3318D6B4019E7CF95BEFBE80124909BA31625251930B3B237BFD936C322A58D53D87", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706865933, "uuid": "fb61a7a4-daf5-4925-b6f0-ffcf20fb9445", "value": "1536:kutWMN1XtHlkNeytlbLD6CHXnRVPaVb5r9v8T:k0fl+eMmAX8b5hc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706865933, "uuid": "7ea4bdea-90c2-4ab7-be26-c443bac8ea0d", "value": 52496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706865933, "uuid": "2db3ac48-87e0-4252-a09b-7c54914851a7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706865933, "uuid": "f265a74c-140c-4345-8d95-4336735ae0d3", "value": "ac7e59b37200701f7f4f0ce0e8171fea", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6594376-c1d2-11ee-b7ea-42010a9c0006", "comment": "Malware payload (CrimsonRAT)", "timestamp": 1706882177, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706882177, "uuid": "552c9f67-e0c8-420a-85db-ea8aa5cf635b", "comment": "Malware payload (CrimsonRAT)", "value": "f5380e7a6e15a0ef27e6f31fcc29ed4d", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "CrimsonRAT", "colour": "#D90F59", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TransparentTribe", "colour": "#862286", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706882177, "uuid": "c3e183bb-c8b1-4605-83b5-063f9dff239c", "comment": "Malware payload (CrimsonRAT)", "value": "e87978f0af9bb550ab4686a7d3657e6cbfd92347744dfce8ff2321781ac2eee0", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "CrimsonRAT", "colour": "#D90F59", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TransparentTribe", "colour": "#862286", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706882177, "uuid": "b2674f1c-c3a3-4c5a-8cfd-0df2280b109e", "comment": "Malware payload (CrimsonRAT)", "value": "ee9d4e5c19dc910ae46f8637ad6d738b55971238", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "CrimsonRAT", "colour": "#D90F59", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TransparentTribe", "colour": "#862286", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706882177, "uuid": "8db140b8-a370-41dc-b0a6-60b8ef45506c", "comment": "Malware payload (CrimsonRAT)", "value": "9f98740c46dde6e7693e75eef62df08343ed1aa9c9f9fc117205c2b042aa2a109315a2e33f3b3050a50e58555744ba14", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "CrimsonRAT", "colour": "#D90F59", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TransparentTribe", "colour": "#862286", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706882177, "uuid": "50904572-b5e6-4d1e-85d3-fb8c55ea86ec", "value": "T18B174270D427E2C8BB4287C848473D892998558F8172F3A9B4E55F5F25D3D83F21A2EE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706882177, "uuid": "8d436a61-9ca1-4082-8684-22ff30021521", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706882177, "uuid": "736a549a-b065-4df5-bcd8-a681fc394cb5", "value": "49152:a/6HjgQAOk7lEX8YHrdDTrr9mJjA1hcu9K5KP497IffvGe:U6Hj5AOkmMYLdf9m6V/1ffue", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706882177, "uuid": "4cde0a3e-7e03-43bf-93c5-eb39a2cca512", "value": 19571712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706882177, "uuid": "bc2fa5c9-8e4c-46d8-bee6-218575f45c04", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706882177, "uuid": "41f585f1-da53-4c8d-a90f-a0f356ac93a8", "value": "itmvroidovs.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc01fefb-c1b4-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1706869248, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706869248, "uuid": "520b7ef5-58b2-4934-b25e-5402bc97fd6d", "comment": "Malware payload (Mirai)", "value": "527a44f4c03ea8efca11e0d65efb782b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706869248, "uuid": "b34b8cb1-5b74-4ae8-adda-2644241ea819", "comment": "Malware payload (Mirai)", "value": "e8ba854f19ca259c0aec4684dfcce7370a3a83a612d888a65bc3d6314796cce3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706869248, "uuid": "23d734d2-6148-4150-8538-ee93b204b279", "comment": "Malware payload (Mirai)", "value": "ec0ae0adc85d5df377167bc0fd67de8a25eee5e2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706869248, "uuid": "3e41c4b4-c706-4ff4-b767-e89b74d508c7", "comment": "Malware payload (Mirai)", "value": "7be50d59fd82fd6aefea76318f392e00c0f03e775581aa20f68729e1150b8244cb3fe23abfb1497be899b26fb0dafadf", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706869248, "uuid": "c16d7d77-0fd5-4c6b-8f53-101cb5770c2b", "value": "T1013329A7B404ED7CF82DE77F4467040EB131B36054C20A6573A6A997AD7B2990C6EF88", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706869248, "uuid": "3ba66613-afc0-49ed-b639-d51ad16be735", "value": "1536:30t3EAtEw0EwsEAqEAeJEwsiWWKd5j8S+wZNsoTtnfaarso75Z:Et3EAtEw0EwsEAqEAeJEwsiK5n+loRfL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706869248, "uuid": "2fb28407-3bd5-4068-a0e8-338baec46d86", "value": 52724, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706869248, "uuid": "a41d9cc9-7ddd-45ec-930b-4e3c85444711", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706869248, "uuid": "802ddb1a-b2d3-4bf5-b200-f96b98e6f956", "value": "527a44f4c03ea8efca11e0d65efb782b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f156df8c-c189-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1706850869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706850869, "uuid": "86b35fbd-3947-4c3d-b1c1-7000e9069172", "comment": "Malware payload (Mirai)", "value": "9f845a126a218536e514a059c13dc84d", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706850869, "uuid": "55d1baf9-726a-4242-a6f8-f4fcbbdb6ae8", "comment": "Malware payload (Mirai)", "value": "e8e80d0f8d2592bc697262ecb361e0e180cbf58826c052fcd70df33b0e1f5a21", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706850869, "uuid": "62fb3120-25e5-4f7b-8e41-92dffe4d4f8e", "comment": "Malware payload (Mirai)", "value": "6a29a981703c3a8582c97d8146211b95c7d213ba", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706850869, "uuid": "f75670fa-616e-40f9-9843-bf4c68e12471", "comment": "Malware payload (Mirai)", "value": "41a97fd46440dd969729427395290f311326af3a8bb3654f4ee068d0321c65d9a598cd851a0430f3fa9e2c2a8a06b328", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706850869, "uuid": "311ec8ec-eb17-4dc0-bd65-b185161e909f", "value": "T169E31A45FC908A23C6D212BBFB5E428D372617E8D3EE72039D216F64378695B0E37646", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706850869, "uuid": "60e48976-32e6-4b3a-b1f3-74d6b04a838d", "value": "3072:XA6p8wRZgfDdB1f984+Wcd/ny1Kzxf2XJ6A:XAeKfrZ984+Hd/nJz12XEA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706850869, "uuid": "a3432edb-9c17-4ff6-852f-fb5b75ae8a72", "value": 146336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706850869, "uuid": "01842cf7-78bd-4341-bf71-1e10e2809fe9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706850869, "uuid": "2e085aa6-1c5c-4973-87c4-b77e6b65c7d9", "value": "huhu.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2882107c-c18f-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706853109, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706853109, "uuid": "4a8083a8-82ac-4efc-9cb9-80298054f03d", "comment": "Malware payload", "value": "732ee820e560b24779c626f4ddf85b21", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706853109, "uuid": "ca7cd11b-9450-4ee7-8e70-429639aff866", "comment": "Malware payload", "value": "e974fde146515355313cb69d3bba96923405d1a16a972a39319b4fe523dd3453", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706853109, "uuid": "6929a5ed-6b91-41a7-8634-ef10705379b5", "comment": "Malware payload", "value": "6a434745b8c46f9da270d190e791284d6c020222", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706853109, "uuid": "da34b8bd-be78-4ffe-8038-aec3eb74a077", "comment": "Malware payload", "value": "d83d0c80b4208bc5773f5575d17e90ed971b329e1d4520acfd147683a2e60125380af6b8f0dd1bdaccdc2c3a14de4263", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706853109, "uuid": "454462b2-6124-4560-b321-f5882ccfd25b", "value": "T1E7C44B006BE89A2AE0AF6BF3987107454BF5F5829595E74BC88131E91F62706ED0373F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706853109, "uuid": "146dc7f4-965f-45a6-8e12-a899cacfcbda", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706853109, "uuid": "e98c5b5e-9ea1-4e5c-ac1e-e9fe0baa46c3", "value": "12288:gqlcVpdb2Wrm/9glARgVwRlqQmGALPokP5dVR2oXA42wcBiDQRD/Tz4ASe3/FvvG:gNpdb2Wrm/9glARgVwRlqQmGALPokP5j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706853109, "uuid": "731770a4-6a32-414c-acf2-5bb0e365424e", "value": 571904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706853109, "uuid": "dd9385ca-f479-4af7-871d-0b6e8c40f460", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706853109, "uuid": "e4579921-1d41-4736-887f-d9fdb6d9ca4f", "value": "Alej.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3dfabf19-c1ba-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1706871614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706871614, "uuid": "e493a176-338d-4695-83c1-d59220d69d48", "comment": "Malware payload (Formbook)", "value": "ea1f082ea4f956a042ec414357eca36f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706871614, "uuid": "abdd3b4a-bb30-457c-b11f-28a4bf03179f", "comment": "Malware payload (Formbook)", "value": "ebdc855d3a59911b5096ed167a66a6f9361c0a367bc9c7664693ef11582d1b1f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706871614, "uuid": "fad6327b-c64b-4252-9aa5-0e9b2e06316c", "comment": "Malware payload (Formbook)", "value": "716723f0569d1cb85861a0b29de2a1c169b40108", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706871614, "uuid": "d5a7d358-608d-44e6-ac3c-1197eed2c895", "comment": "Malware payload (Formbook)", "value": "7332b65f120ec0cda09bae97aa0ff75a42078f7b4da8425de4dd435720f7628d60d26e1c9652abb29685426f9a7986dc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706871614, "uuid": "b9649a24-09cb-4fbe-ad99-bc12f45003f9", "value": "T127F4BEAD365075DFC867CD72C9A42C60EA6064BB930BD213A12715EDAA0EAD7CF141F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706871614, "uuid": "2a8667a7-fbcf-48a7-b8f7-473d92ce75f3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706871614, "uuid": "0c654faa-bade-4677-a65c-95b2e330360f", "value": "12288:d7D0L/q+uJOgs/z3i8D+KnIqsW1O7YP5Hd9dpsjp5MeoiaqFd53rD22ryMGCIUBU:NYC+TZm5qc05Fpsjp5MwRZrD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706871614, "uuid": "3eb3d891-2fa6-40d2-977d-05b2ef37fd95", "value": 761856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706871614, "uuid": "ebb368b0-8066-4e5a-be3c-d6f1ef4aa311", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706871614, "uuid": "bc575b37-20b0-4503-b7d0-6e2106bf4096", "value": "ea1f082ea4f956a042ec414357eca36f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26faf4e6-c1dc-11ee-b7ea-42010a9c0006", "comment": "Malware payload (IRATA)", "timestamp": 1706886178, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706886178, "uuid": "225ef0a6-2a2d-4902-bbf9-fbedc8a74fc1", "comment": "Malware payload (IRATA)", "value": "3cee1a4894f31bf51415d7d86d82c527", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706886178, "uuid": "77d68650-383d-4ec7-9890-9663ff7d5b75", "comment": "Malware payload (IRATA)", "value": "ebe99140a622eb9f0483bad3e9f81ac5bd6ebab5d6619d1485bcdec8b7f87af9", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706886178, "uuid": "5b1774b2-0ac9-4127-817c-f39ec5a4d9d1", "comment": "Malware payload (IRATA)", "value": "8e1f4ee2b27f0edc1c4820586653bb74e6031482", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706886178, "uuid": "f8029dab-014c-4355-b647-1f42301b4ea6", "comment": "Malware payload (IRATA)", "value": "641f642a0e1f7fc755f0e50437fc9d1805578cd5629420ddd60b5dc49d142e8426da3c5d49b21646973b51e16b79959a", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706886178, "uuid": "e5e86d3f-dc29-456f-9116-53dd409c2b63", "value": "T15EC52313F636A91BCC36C07326882735651F9D1CCA42764E385873AE78BBDE84BC56E1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706886178, "uuid": "c975d65e-2545-4990-81c3-df49ab126c82", "value": "49152:EHQJvBBKzXJrCBknbLwKgLMyuc36PYhMStxc6nl+geT828OmR:EwJ5MXJrPfwDMyu0pNtxFAgnu+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706886178, "uuid": "1f060fc6-1493-445e-b6f9-23880ecaae24", "value": 2575288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706886178, "uuid": "93c9e57d-48a5-4882-8dc4-c9839335690b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706886178, "uuid": "93962d29-36b9-4215-b18b-ea946593d89b", "value": "SANA.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10c99093-c1bc-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1706872397, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706872397, "uuid": "52c4acb8-dfe9-49ab-bba7-77495e5706f6", "comment": "Malware payload (RemcosRAT)", "value": "3e0dfcd2f7010bd370306c016827d1d3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706872397, "uuid": "e7aff5d7-12e3-481e-8d06-4312999fb505", "comment": "Malware payload (RemcosRAT)", "value": "ecad62ef8415885ac40c6e3889e323293599d9ed531fe62d77e1488c925650d5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706872397, "uuid": "82bbf067-864e-4ca1-b72a-26370dbafb63", "comment": "Malware payload (RemcosRAT)", "value": "328bc88367198631240b597a95f778d88dc8203e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706872397, "uuid": "59de86d3-04a8-402b-99ba-f55f8e49e825", "comment": "Malware payload (RemcosRAT)", "value": "386d6eee33cc3180bd042d4292469860edb4e3e5fc199503cd3deed68f28ab262a3cdc9e45baf4934bdcd3a53d5ce01b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706872397, "uuid": "7d684822-a782-4649-8ccc-401efbd67fa0", "value": "T1A555E0812AB48F14F93E9BF544650110A7757D5B782FEB4D9EC0B0FA1EB6B400E93A27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706872397, "uuid": "b9ac319b-9222-4676-803c-3a0fc6db133a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706872397, "uuid": "8293a0c5-3fb2-470c-b440-43bba6535d4f", "value": "24576:2MyUmzGrDS4gAM1CgzCc8C95cdjX5StGpvXpChTTQ6+HN:pDS4gAM10pS5+jpSe5ChTcBt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706872397, "uuid": "0982692a-ae88-447b-aa0c-f4f139d13c08", "value": 1305600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706872397, "uuid": "3139802c-ad37-4cb1-8d6f-7ee0b50832f8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706872397, "uuid": "d07eaea3-7e54-4afb-9c10-50aa6fcbbc91", "value": "DHL AWB 32536063331.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25e31428-c1f8-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RiseProStealer)", "timestamp": 1706898202, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706898202, "uuid": "7d270118-6bf3-4e45-a920-32a3890721c6", "comment": "Malware payload (RiseProStealer)", "value": "a75289fb7bd37aedc5fdc1da76cf522a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706898202, "uuid": "3c96dd88-30ef-47da-8d63-44f20e65f625", "comment": "Malware payload (RiseProStealer)", "value": "ed5853637c726919aca5628b78d11c214983b93bf267337a3b485db5efd92270", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706898202, "uuid": "06891e40-abea-4956-a515-34194f9cf886", "comment": "Malware payload (RiseProStealer)", "value": "ae01e15a9e6f3d647b4531efde686790650c65ae", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706898202, "uuid": "152cfba5-1259-4ac5-a955-0edf9116a001", "comment": "Malware payload (RiseProStealer)", "value": "0e57f0fbcf89fce285bd5fb9212535cbd5342aea9d451b231eb35da1539c4cf59a0e4559a8b61c425326c7961f6c41fa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706898202, "uuid": "a20062bd-f5a1-45db-9818-648b36fb97fe", "value": "T13AB533F369720669DC5327F25A028A255753AC634B88205ABF55FE1963BFF3048E7F20", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706898202, "uuid": "ee8adf33-dca1-4d27-96e7-b3424201bbcb", "value": "baa93d47220682c04d92f7797d9224ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706898202, "uuid": "e0591c0f-9e42-4e3d-90b0-3f53a2273611", "value": "49152:TO4rxY9qisCO/PWUnZzJD9BMKO3R02dxVSCbXw/5YUwfP:i4d2sCWWOEVR02X8CTGHS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706898202, "uuid": "d78bdaeb-d488-46c3-ae72-b60c188744e7", "value": 2332160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706898202, "uuid": "63c5495f-baa4-411b-a887-1df4930ee400", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706898202, "uuid": "43f281e4-9580-4b93-b5a6-d78476841743", "value": "SecuriteInfo.com.Win32.TrojanX-gen.30698.14058", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b82adaaf-c200-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706901884, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706901884, "uuid": "662ac697-1fb2-4212-b157-e655e18e5e65", "comment": "Malware payload", "value": "9ec1ce4d68b167cece2396d7db66860f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706901884, "uuid": "52806b83-573f-4b37-8a2b-7c5de5000792", "comment": "Malware payload", "value": "ee36578238262d314a5101bd208ddd7d0131f0f974561c500a5c352dcc49437a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706901884, "uuid": "9b1bcec5-4d27-4637-a01e-f1031a8cd5ad", "comment": "Malware payload", "value": "60524cfc3b8d8da67585654d945209bb17531015", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706901884, "uuid": "3b8178f3-518b-4680-b40d-e707cffea0d0", "comment": "Malware payload", "value": "fc3f646eddcfb355cd25b1129996659eee20e151a5c221f4e6cd601dfb73ae0ce0192187abc8948af0ec11ff14d2d00e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706901884, "uuid": "064ceaa0-162a-4c2e-b075-2924ee920039", "value": "T194F633788532B89CDCD0DEB2CC516D89CE09BC6AD524181F6D95B0BF88BED38479B4C6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706901884, "uuid": "1c730723-d606-470d-928a-76595dcacb2f", "value": "b1a57b635b23ffd553b3fd1e0960b2bd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706901884, "uuid": "b88d7e6f-99d6-4fd8-9ce4-018242533c6f", "value": "196608:h91N5maBNqCOtM+sBIL4VOpk+k+jayezFcmLV3wb5UnZo2C4R+SF8B+N:HoEtw4B2RJW3A5CZJ6B+N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706901884, "uuid": "b24ea67b-2375-4168-8f4a-49ccbbc2eb73", "value": 15617744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706901884, "uuid": "7c72fae5-fb62-425d-a5b2-67f001a99fc7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706901884, "uuid": "56d07bab-f000-483e-b7fa-9651b7e0c29f", "value": "SecuriteInfo.com.Heur.3530.2577", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ff5d6ae-c164-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1706834680, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706834680, "uuid": "6f0639b9-50a3-402a-bfea-11afb9addf28", "comment": "Malware payload (Mirai)", "value": "405240c5ff951d08c791106ae8bf79bd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706834680, "uuid": "5132bf7f-08d6-402f-94b4-a413e9fb335b", "comment": "Malware payload (Mirai)", "value": "f10c3cf19e6db4b0f9d22f79af872b8dbad46b2a421fe70835a243b88b169f01", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706834680, "uuid": "f35e491c-5288-479c-99a9-8446a20e7348", "comment": "Malware payload (Mirai)", "value": "92bed559accc7eac384884c278837de719c9f457", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706834680, "uuid": "f4072166-b887-48d0-b170-353248a1cf07", "comment": "Malware payload (Mirai)", "value": "5ea8fe9d0f928e0da1c9285ce2e27a6cf17e8d71c26ec809bed144ffc365efc1dc265c309c596cbb5eb0e6917805533f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706834680, "uuid": "5980d745-d90e-44d6-ae85-dbdc4c077db6", "value": "T17A73A9092E358F6CFB5D823697B78F219758339626E1C645E16CFE021E7024D341FBAA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706834680, "uuid": "206fba66-9b64-4584-a014-ba7612be34bc", "value": "1536:lo89L2T27mQaXcn6EyvXqaQSiIHW5VU+6Y3jfhdR2QEc8LMkEd42+T7w:lo+2TIaXIE6aZiIH0VU+6KfhdR2Hc8L6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706834680, "uuid": "cef303fe-aa2f-43c5-b262-72e21a5fef7c", "value": 80188, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706834680, "uuid": "5416858e-6ef7-4565-b9b7-2fb166edd074", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706834680, "uuid": "39c3889b-2ff5-4672-8dc3-7863eb257385", "value": "405240c5ff951d08c791106ae8bf79bd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0d03986-c1b3-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1706868827, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706868827, "uuid": "334e4cdd-8978-4eca-bcd6-07398c464656", "comment": "Malware payload (Mirai)", "value": "720b3c87df67e4e1618cb1659851a0ff", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706868827, "uuid": "d0c7a8b1-9df6-47b1-ab37-33ee5d503c4b", "comment": "Malware payload (Mirai)", "value": "f32db9f7a02577be18087245dd9b462a61d6794a850d43a46ccdd3ad248c4d2c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706868827, "uuid": "778224c9-21e0-4a61-9ba4-d07d69ba0187", "comment": "Malware payload (Mirai)", "value": "f60347ec9988fa870164fb59e458188378048cc6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706868827, "uuid": "4cc8e030-8053-4c6a-b69f-9c19b065b4de", "comment": "Malware payload (Mirai)", "value": "a9f4ff0ce5842450ff4fc712a8904103210403455eb5ba2ab57d112c3c99bc6b333023bd50dcca87f43d826deed62ec3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706868827, "uuid": "f3b6e76b-8854-427e-ad9f-45bc58e6ebca", "value": "T15AE3F883FD01DFBBF80BE372449308157530BFAA4D625A73B21778AADA390D41567E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706868827, "uuid": "f40b3b55-e1d3-4e91-bf26-7b53bf8b6ffa", "value": "3072:IzAcgspGtztAKNTevRJyz/Diaq2EQiXyyfVMjbiXLcPDb2:65HUtztABjyz7ia/ElyyjLE32", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706868827, "uuid": "03f2284f-318c-4dc7-a970-b7e53b43ae06", "value": 155548, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706868827, "uuid": "47aef62b-dcd6-48a0-a46f-ffad83347d5a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706868827, "uuid": "6bd08ada-cdc1-46a9-8d52-e8192cbd8a70", "value": "720b3c87df67e4e1618cb1659851a0ff", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11b51f37-c225-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706917496, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706917496, "uuid": "4ee02cb7-5871-4ce0-9294-3e28b0fdc5aa", "comment": "Malware payload", "value": "6420d7b87f9a45bf7ded340a5ef4e17a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706917496, "uuid": "13fd6b07-7e8b-427a-a242-3b871fea2b53", "comment": "Malware payload", "value": "f3cf23ba078950da05d1083572898338a9a8cb7dbf149dd89cea0d6f52e8849d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706917496, "uuid": "bb72e53c-209d-455b-adb1-4a5cec4bf20e", "comment": "Malware payload", "value": "f1a2b43947533ad4b3e85028bef56544b5275ea4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706917496, "uuid": "77e275b2-5a06-4e5e-8d94-667dafa0c8ea", "comment": "Malware payload", "value": "5b97ba2f1a541bde91d85365cbb3f0b0bb37953f002136e30352e918e933e0169edafd7fb9e594890d0f5b3b4e9a2787", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706917496, "uuid": "0173be99-9144-493a-9638-a03d5e8f0d64", "value": "T1FEB533C06E7961E9C36F873D830749B442AFBF274A10961D3588F6C54B7C076A2EAE03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706917496, "uuid": "32000b62-7d3a-4726-9ef7-615ac344f42a", "value": "baa93d47220682c04d92f7797d9224ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706917496, "uuid": "a3d14a91-1552-45d8-89ea-75e08fa89ca1", "value": "49152:SxzU8eWjb0D8GF2sQNoXIj3MLX61i27X5iSM5H18CTI1GU+vu:S/9oXI4QVYt5V8l7+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706917496, "uuid": "094133fb-cd6a-4ca4-9977-d4ba2c98ad56", "value": 2339328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706917496, "uuid": "fd7b8196-631d-4ca8-a462-eaf1f1ee10ba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706917496, "uuid": "b034e010-8a3c-4af9-bc16-ec381c47de0c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43e34c89-c1cc-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706879355, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706879355, "uuid": "f281b88a-7e43-4f77-ad8f-46eca8e109f7", "comment": "Malware payload", "value": "bbf38187c075170e25484426b46e4a6f", "object_relation": "md5", "Tag": [ { "name": "discord", "colour": "#27793F", "exportable": true, "hide_tag": false }, { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "EpsilonStealer", "colour": "#559F06", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VoidOfSpace", "colour": "#2B15CF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706879355, "uuid": "452d246b-f938-49f3-a73f-1c4a0f3a8abd", "comment": "Malware payload", "value": "f3f9345e017822740571c49dd0c90c0c1f2c7f7110f1e1cc1ca21c53c5c81fcd", "object_relation": "sha256", "Tag": [ { "name": "discord", "colour": "#27793F", "exportable": true, "hide_tag": false }, { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "EpsilonStealer", "colour": "#559F06", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VoidOfSpace", "colour": "#2B15CF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706879355, "uuid": "cd1a21b4-7a23-4891-b5a8-8a7d15f81af6", "comment": "Malware payload", "value": "6519bdba0e5bd010461ea590c5f38662dfa87710", "object_relation": "sha1", "Tag": [ { "name": "discord", "colour": "#27793F", "exportable": true, "hide_tag": false }, { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "EpsilonStealer", "colour": "#559F06", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VoidOfSpace", "colour": "#2B15CF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706879355, "uuid": "b025bc4c-6b37-4eef-909a-2b9b0b75e932", "comment": "Malware payload", "value": "d51697a41b4b0f41a55cbe2a4ed66cfe6c1bfb76e911f2175c0a538ad6cc736778dd5066fcd6ae4c55929d83dde03c99", "object_relation": "sha3-384", "Tag": [ { "name": "discord", "colour": "#27793F", "exportable": true, "hide_tag": false }, { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "EpsilonStealer", "colour": "#559F06", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VoidOfSpace", "colour": "#2B15CF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706879355, "uuid": "deb55494-7d28-42b0-9c9d-9e7e8f7c4e06", "value": "T1BED7335CCF59D84BCCA9B6345423E53A7239DD0B24D815624EF0BC4F32EA8663A5E31E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706879355, "uuid": "0ece19f4-1e59-4cae-8e16-3ebdefb91115", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706879355, "uuid": "cb3303f0-ba46-4640-9121-31b386389ec3", "value": "1572864:k8tpKowaCtAUnFMTLCHhmPCF9BDPFqhtMQdkzc0H5aA:Nt4owah1a/Pb5X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706879355, "uuid": "99d180c4-557e-47f3-807b-7a2b1b1df187", "value": 63266808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706879355, "uuid": "21d9838f-b8ca-4467-a39a-c4b7fdf2e1b6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706879355, "uuid": "788fe800-b720-4516-ac27-0c7facc7617e", "value": "VoidOfSpace.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4948d624-c18b-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1706851446, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706851446, "uuid": "858ecf18-d3e2-468d-ae43-6ba761881300", "comment": "Malware payload (Mirai)", "value": "d445e5fed77e5d9be89f401dbaa777d5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706851446, "uuid": "0ef49569-5f27-46c3-942e-031eeaf85db7", "comment": "Malware payload (Mirai)", "value": "f5927e0ae40b6cd8eca298f039850b0785d3b6ed39943af3710b9f18ebea8736", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706851446, "uuid": "73cfeec3-4b3a-41b9-9b13-8a6c565a610f", "comment": "Malware payload (Mirai)", "value": "f0d9725f175be0a08b216a66d866492fbf2b4864", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706851446, "uuid": "d45d589c-21b0-4abe-8ea8-1c913735e79f", "comment": "Malware payload (Mirai)", "value": "faca4d72166fa8349819987da67e9a3e357d1472adf21d0c389780106303d1d41bfb05f9bc899dc0136feaba0d687db8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706851446, "uuid": "b6a18b18-922b-4d19-bd5b-84575635fca3", "value": "T161130995BDC2AA06CAD0077BFA0F428D3716639CE2EE7613DD212F51379A52B0E6B111", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706851446, "uuid": "20ea9ed4-59e9-400e-b3f5-dfe789e27e66", "value": "768:mniq5P6Ra2EOzU54RhT50v+Sf7wFrKto9LCwWs6VqzJ2mq2Gz:YEE0lRP0jMsS9LCDVs16", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706851446, "uuid": "4d2f23ff-38c3-4a90-8cdb-b9e4dda84f36", "value": 45076, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706851446, "uuid": "962c2016-bde6-42e1-9b0e-7eef0c62dae0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706851446, "uuid": "cd4fdfc9-f271-4187-be02-4ae51ccb88a4", "value": "d445e5fed77e5d9be89f401dbaa777d5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c56cf34-c182-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706847667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706847667, "uuid": "ae7dec1f-2f54-4881-92d5-3cbc8cb7be0e", "comment": "Malware payload", "value": "c59a70c2ad71af1a4f67c6b56472eb67", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706847667, "uuid": "2d906782-8231-40b6-b6ba-ab9783c0b4e4", "comment": "Malware payload", "value": "f6783eecd0902e23bae98fd57c2dac7667132e2be98bdafc0e0d7b75c137b425", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706847667, "uuid": "44219e92-a5e7-441e-8c8f-75add749a791", "comment": "Malware payload", "value": "ece074c67620aa6d7df57b54619c1aa02f600c68", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706847667, "uuid": "6281a5af-2763-424f-9b86-0919343f0d61", "comment": "Malware payload", "value": "59b1a151ef7bc3b47c914e4bcb374f48aaea6ba81efb07c4d3a7c89ea933c4760e45431ff055479129b5bc4df925f761", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706847667, "uuid": "f1eec074-49eb-4501-90e8-c1dd870e1337", "value": "T126A6233FB228653ED5AA2B7155739360497BBE62681A8C1E07F0190CCF364715F3FA1A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706847667, "uuid": "52aed1f9-a270-48c0-8d4e-51729869a7f0", "value": "5a594319a0d69dbc452e748bcf05892e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706847667, "uuid": "5d494bd0-531c-4a26-8b83-fcd97bc5460b", "value": "196608:qYRyCv7s20A5C2V0c7jcETLN/1B/qIkSe+76vwEQoHPl8tBP74Uu:qY1TZ0iC2YETLN1B/q7j+76vwEQoGbP1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706847667, "uuid": "dc5ce6e1-3f7d-4cb0-bb8f-d91a4c3a7a69", "value": 10112144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706847667, "uuid": "2c65d7a3-cd4b-47c1-bebf-8c4461df2816", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706847667, "uuid": "9e50b697-c98f-4995-a3de-6dcea28f0411", "value": "SecuriteInfo.com.FileRepPup.20374.13747", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a5a5330-c1ba-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1706871608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706871608, "uuid": "62cce5dd-1cc0-4e92-9091-939d783e636f", "comment": "Malware payload (AgentTesla)", "value": "fd826d94511b1cebced607c4878307bc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706871608, "uuid": "b6957b7f-e304-4e95-b72e-dc0242e1b26d", "comment": "Malware payload (AgentTesla)", "value": "f95e05bbe87a340752167e839dccfc666ccc90f07a1ddaa49df0cd5629e62326", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706871608, "uuid": "391aeab5-e3bb-4eb8-b619-14f76245106d", "comment": "Malware payload (AgentTesla)", "value": "8d49913740ea2db03d84852bdbc424ee47e7081f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706871608, "uuid": "01aebe74-c00b-4138-b8c0-c0c4cda8c37c", "comment": "Malware payload (AgentTesla)", "value": "7146ab87e7c45f1f8ff6765144ceb9165ddf3a9a5b6f97a80dddfa173726033d2e5d9d44cb92122b3c017d9a641b003d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706871608, "uuid": "0d5b08dc-e28c-4ba3-b9ef-3e0d99b69c43", "value": "T10FF4028132B90FA6C13ECBB025B994459BB2792F6522F61DAECB71DF2436F190711E07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706871608, "uuid": "b0395aea-6636-456f-980c-65dff7c33419", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706871608, "uuid": "da8a5a7a-b966-4890-94d0-0880341a2d56", "value": "12288:vXd53rD22C0qohO4hiuMBDcrLQqaIvHbjhqb8Hh+h:TrDc0SCLc4TvHI+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706871608, "uuid": "dea372cd-d64b-4753-8684-c3410bbef15b", "value": 731648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706871608, "uuid": "72c276e7-2ef6-4f3f-81ec-e5a289450b05", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706871608, "uuid": "8a6a4d4a-3a21-41f0-8822-251dd404fef7", "value": "fd826d94511b1cebced607c4878307bc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6415c8e-c1b3-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1706868863, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706868863, "uuid": "05015971-bfdb-4d5f-bb0c-1c87448e6e2b", "comment": "Malware payload (Mirai)", "value": "b98faa19dde2b01633e289f50b2aa177", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706868863, "uuid": "a1b93b67-fa98-48f5-8da8-81f99e263a0d", "comment": "Malware payload (Mirai)", "value": "f9ab059537108dd922864734e23c2a40fe5ebcb418651d120ba73c0a7ac9e9d9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706868863, "uuid": "713dd107-02c2-4803-bec8-67d654e1d003", "comment": "Malware payload (Mirai)", "value": "f0a37b612069821f7b3e28b09dbedcb34cc6e187", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706868863, "uuid": "5589e39a-57a8-4627-b3b6-e55a6a124edf", "comment": "Malware payload (Mirai)", "value": "6681d9fbb78dc5789afea62564857953ddcef967d88365eff60cffc8280573a9ac09c0f1ba02bb459bc00420ba6ccd3d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706868863, "uuid": "e2ffe778-b584-4073-9284-97cd5ae101e7", "value": "T121332ADAF8028D3CF94BE67E54174A08FA3163D51283172627BBFDA36C731992913E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706868863, "uuid": "ce9f70c8-e7e2-45b4-8445-6f06cb2f463d", "value": "768:GFeN8oOR+OfzRX1nR3Icb8+PX5OCerv6yVjR1kj7TLXe84CdGD:EyaJfzW2PXYCeeyVjRC7Pu84bD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706868863, "uuid": "7f8a8c10-bae5-41b0-957c-ac6e4545f9b3", "value": 50172, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706868863, "uuid": "dc01dd81-a9ec-4d31-8ab5-f51c4fa47780", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706868863, "uuid": "a240551b-28df-4bef-8297-c0f8b0074478", "value": "b98faa19dde2b01633e289f50b2aa177", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f30de938-c1ad-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1706866334, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706866334, "uuid": "cd707edc-b285-48c1-9b7d-591981427cac", "comment": "Malware payload (Mirai)", "value": "fef4b46fb72441a2563d735c43e6db6d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706866334, "uuid": "adc2fbc2-b204-4e29-bc36-0a577840b34a", "comment": "Malware payload (Mirai)", "value": "fa50f25e537aca6c2ac684e406e4224eff216b266b98525bff22cc7464c3fc7a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706866334, "uuid": "5abaf4ee-0034-428b-bee2-4cf3296bdd83", "comment": "Malware payload (Mirai)", "value": "a79a0dc316122676b2ffdcc6835c8f5fceaad7f5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706866334, "uuid": "357ab3e1-b579-4ca4-b468-7ada02e9739e", "comment": "Malware payload (Mirai)", "value": "400bbaccafc04d2008a3e7db5f8aa9e1ae26be3c90484bd4851a490b8641845be5a89a33795452976f99c35a7457e6ee", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706866334, "uuid": "f8dfe08d-a7b2-492d-8723-2e818a655afd", "value": "T1FC73840E2E619FBCFBAD863587B35F209248339626E1C545D15CFA011E7034E746FBA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706866334, "uuid": "11b91e47-4b64-4a6e-b5f2-5da0d5077444", "value": "1536:G4Z8LUay6+vl/R1KIdysUmR9EiYHXw5myGhJqv0ZjDETh:B6ry6+vdGIdysUKqyGhJo0RDIh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706866334, "uuid": "a8dae116-5f31-45f9-82df-def6b30345a6", "value": 79804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706866334, "uuid": "bbff5ce9-0867-440a-924a-86e68387fe90", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706866334, "uuid": "ef50be82-4418-427b-bab9-e4f4140d638c", "value": "fef4b46fb72441a2563d735c43e6db6d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b988673-c19a-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706857839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706857839, "uuid": "7b7407cf-870a-4f8e-b808-950fac9ca16d", "comment": "Malware payload", "value": "e49d435402ff8f03d07c3a2bb0c4a111", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706857839, "uuid": "ef298fd2-902f-41cc-b7fb-acd0af295f90", "comment": "Malware payload", "value": "fa9abf218cb87f009e766144d05b2e0c32e06729ff8feab06a6ee47690b862fd", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706857839, "uuid": "e8c3e3bf-9ebc-4116-9d01-2883d37da0bc", "comment": "Malware payload", "value": "ef9f65bc5383895b1a970a5c75d1d386f86c8d9d", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706857839, "uuid": "a5e1ebc1-01fa-4ffd-bc9e-000b6354b031", "comment": "Malware payload", "value": "3add9b58347d826b1354fb906232ac138454c5a9f6cdb852283124c9561748b34424ee4edd5f5b7208ed0c019ccd9da4", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706857839, "uuid": "1d0943d9-75b1-4aaa-990c-4717a2716aeb", "value": "T15C644B32367E0305FA25B2BDAA107C96A241BD8A8CC5EE32F191383D77D256F94C45E7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706857839, "uuid": "aeec6dae-131f-4bd5-a70b-abafab352bb5", "value": "3072:g0lWbNYL3rCQbImclzzRMHTwwRAyeuQmIDqYKlcGScQkdw8oo:EN23rCeImclzzRMH1RAyqKlcQQke8oo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706857839, "uuid": "a3bacc66-48da-449f-847f-89fae3d9b73f", "value": 308924, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706857839, "uuid": "5fae3851-14f0-4ba8-a7fe-459a038585ef", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706857839, "uuid": "15d90267-9d82-4512-8eb6-94d45fee927b", "value": "RDER Report.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a05f3c18-c1ef-11ee-b7ea-42010a9c0006", "comment": "Malware payload (PureLogStealer)", "timestamp": 1706894542, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706894542, "uuid": "be9a4847-6b74-4e27-ade7-5205713e09d6", "comment": "Malware payload (PureLogStealer)", "value": "b71112887e2b67a93960842b156d3807", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706894542, "uuid": "0d0e9469-574b-4dc2-9188-8083e370d0be", "comment": "Malware payload (PureLogStealer)", "value": "fb740e250acd2f9d5d5de59d9292b4f49c866dd0ae4cce517a734df814ac9b56", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706894542, "uuid": "1a84e73b-5e84-4f40-ba64-d90df36d04d2", "comment": "Malware payload (PureLogStealer)", "value": "b0eff518a41fbf3ccafc79ae0cf8b195266fcbf8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706894542, "uuid": "f255462d-2393-4195-94c1-11d8e708fe33", "comment": "Malware payload (PureLogStealer)", "value": "7c4920f8856856997626d410ff1d07bac286b25c6b5a49c378163d334484d72e7966f1974f6bfd83e243c8b1a2e9eb07", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706894542, "uuid": "d0830efc-e51c-487e-90f3-b152f559c7bb", "value": "T107D4E1A967528D17CB7667B5897397020740F6F74423A34BA3C9A275B01B2BF1FA1B03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706894542, "uuid": "da587c9c-c5fc-4aff-a4b5-2c5f88b052d2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706894542, "uuid": "9de31083-7177-458e-b017-324953f5407f", "value": "12288:yURiMnuidG00+Dw9d8b9JEjnA3VVnKC2/z+bsOBxLkzNk:4MuIGH+090CA3KvLI4zNk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706894542, "uuid": "d5449f43-0efa-4a9c-b3ee-ace4e2b61347", "value": 641536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706894542, "uuid": "d5174ae2-c134-42a0-be9b-d7361905bc81", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706894542, "uuid": "b3e62bd3-f41d-450d-bab7-41bb7059465d", "value": "b71112887e2b67a93960842b156d3807", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4054b2f-c1bd-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706873208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706873208, "uuid": "c975b982-bb7d-4e76-beac-de0edb5c8d25", "comment": "Malware payload", "value": "43ca1ea4a10e992c4c48085b8e8bc69b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706873208, "uuid": "75456877-38b2-474b-88cd-f5dae7c2aad0", "comment": "Malware payload", "value": "fb95ac6e639e2e70bccf34921bd0ab868dc1abb8917ed56b28b73e02e2c96fe1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706873208, "uuid": "0fa7dcd2-1eb0-49c8-8647-1e1590c38aeb", "comment": "Malware payload", "value": "1d03a0d37d9be7ce703d034abea3e754e6ebc4b2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706873208, "uuid": "0c0512f5-9f1e-4d39-b71a-3cc26e26b8ac", "comment": "Malware payload", "value": "f035ef8f5c56a936bf225484c92d117692e5429c449f95dbaa9829492571c7a09c22f458b23de98d2f17f81bf5e18e30", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706873208, "uuid": "5173768a-0d6c-4064-ba47-e8aed5e3410b", "value": "T167A7230B66F5412DE1B2C671ACBFCE6159657C6F5A36818BB280EE081DF0781B923737", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706873208, "uuid": "423ade94-7573-4331-82d7-33d799b82b06", "value": "4e96b11dc774bb826232ae325fb1370a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706873208, "uuid": "c5644db5-0839-4326-9451-fbcb8966cdef", "value": "786432:/gNsw3znhr1JaOo2FsVPPt8aEWJbxteXi0DwMdubhPTS9:/isyznhrc2Fslt8aXdQS0sP7S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706873208, "uuid": "9d2a10bc-ea02-41d2-b125-89a2ac1748bc", "value": 44515280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706873208, "uuid": "1a34206f-08c2-49d4-acd4-acdc9da85f36", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706873208, "uuid": "82a50315-e4e3-404b-9a7b-d4fbe9dc572a", "value": "SecuriteInfo.com.Program.Unwanted.1364.7514.2623", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "321fa14c-c164-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1706834657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706834657, "uuid": "12b74253-cbab-41e4-9a83-bba2165be0ea", "comment": "Malware payload (Mirai)", "value": "1c7302311aa56a0be3628c6d61e80eba", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706834657, "uuid": "ff491c99-513b-4219-a983-6290d4dd2556", "comment": "Malware payload (Mirai)", "value": "fc6cc3e0b1e68a0148560e6b37d2572e025f787dc131abec81d24f43c44aab24", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706834657, "uuid": "5d9941a8-72bc-4d9c-9e1c-c273421af959", "comment": "Malware payload (Mirai)", "value": "6d12fc719c51c6296fa2d340f4203fbb4d89bcdd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706834657, "uuid": "c23e8656-68fa-489b-9e61-20186f4abae8", "comment": "Malware payload (Mirai)", "value": "3a5aab353e359918008f47a5d5aa20ffb71509727b89e08eee5a6df578549f8a6053d5415ef1dd0298a47a81b208ca69", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706834657, "uuid": "72acae9c-a978-467d-9707-af49042b8314", "value": "T113438E36C47FADA8C5858638A42149741F63F50882A7AFFA9BC587645047FFCF6083E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706834657, "uuid": "6fa75fec-27c9-4d63-9c26-d5e46628e67d", "value": "1536:rHdIcHE2ZwtdW4KWjUKbq9V9R3qLw2h5Cw3d42+:rHFHE2Znnz9ZqLw2h57", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706834657, "uuid": "841cc620-4b21-4cb9-ba5a-41d37aa6ee8b", "value": 55212, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706834657, "uuid": "bd2b7d6e-2c20-4e99-906d-66c7d4a7ff3d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706834657, "uuid": "a8614f54-b60e-4404-bcdf-7fbd0eaef03c", "value": "1c7302311aa56a0be3628c6d61e80eba", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33f0e765-c18b-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1706851411, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706851411, "uuid": "99329cc8-9792-425c-9e81-e98135b91953", "comment": "Malware payload (Formbook)", "value": "ca118c5aada497740dd2c0d321bf62a6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706851411, "uuid": "f9e6765f-75c2-4150-9704-892b21f1065b", "comment": "Malware payload (Formbook)", "value": "fd29481d9b24abf8113109eca6daec04a08877dd82ce9cccf3768f93a4ce53ab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706851411, "uuid": "3a6e59c6-0163-44ba-8930-0932c286c785", "comment": "Malware payload (Formbook)", "value": "495d961140a0df1f2c91af48cf288feb7f2a863d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706851411, "uuid": "9781f000-a1b9-4fe9-96b8-fe68e5bc04cc", "comment": "Malware payload (Formbook)", "value": "2dfda12218432a42845a595dc8464275ec3704bdb0c0e46d24faef3637fe96fd1f4c1139022e2a22296adf8d8f841323", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706851411, "uuid": "a444034a-928f-4d1c-bb79-794821437fa6", "value": "T1FAE4121762F90B72C2B947FD753052414BF2B96BB201FA4E4FC970EB1D66B018B50AA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706851411, "uuid": "8778a659-be94-41fc-97e3-e735aabb1b21", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706851411, "uuid": "ef9777b7-af01-489c-81c0-c721327c160b", "value": "12288:2kr3Aj+1Rf0xiP/g1UFWbNT1b213ZyEQUNOdPl8JSRmkTTd53rD22c:/jAjgf0sPmtEudiNU/rD+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706851411, "uuid": "bb9b339b-6cc1-4bfc-a2b1-d4808985e2ee", "value": 712704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706851411, "uuid": "13d0cc7f-0ab1-4e44-ad01-6f1b55a96936", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706851411, "uuid": "712aaedd-d3bd-4283-ac25-281edef9e19e", "value": "SecuriteInfo.com.Win32.CrypterX-gen.22358.8429", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f395cb8-c1cb-11ee-b7ea-42010a9c0006", "comment": "Malware payload (GuLoader)", "timestamp": 1706879025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706879025, "uuid": "5c922f3e-1f0c-42cf-a103-bdc01e612e6e", "comment": "Malware payload (GuLoader)", "value": "ca05d10ce0d516170e71372d2acbfed4", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706879025, "uuid": "680ab8c1-2d8c-436a-a1b1-b8cd69e9c783", "comment": "Malware payload (GuLoader)", "value": "fdc6e131d64dd0ad35a1b4a9b0dfdc7c4e2ff61589fcf71e72fa8623e0700acb", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706879025, "uuid": "12fdb883-3528-498b-9c14-5ce65a25ba6f", "comment": "Malware payload (GuLoader)", "value": "78cf74c127c05cb9dca92b42388a187aad7c0526", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706879025, "uuid": "ec55cb39-b745-41ad-bff4-4cc8c1b591d4", "comment": "Malware payload (GuLoader)", "value": "a3bfdb40909554d5cd6b4755df5fd3d548b9f0931916eded4121a577c72dfc64051aa3c9d121ce92e3a29685810f2509", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706879025, "uuid": "ce3665c2-f628-4311-aa49-5c8bb1a4b069", "value": "T16D23026A4BF82EAC09A0379DDB311453218F1BF994B2475BFC945DCB5F60B01E993E41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706879025, "uuid": "71a9f226-c86b-42b7-a1aa-6d6d9590cb7a", "value": "768:T/f82cW3X4/Dg/Nu8+46B9BJ4Qa6Gba9bU5AM9Pr6ymYqzlRoJ0IzbOZ0Rd5ho+J:jfrNH4c/Q4AziQSbl9WyYoyYh7o+V6FG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706879025, "uuid": "1731b522-4075-4a5f-953f-824d815e249c", "value": 49057, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706879025, "uuid": "9489b657-0f92-40c0-8b7e-0e03beb8c148", "value": "application/x-lzh-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706879025, "uuid": "795a9777-1afa-46df-b3fd-ac8e5b8403a6", "value": "nNew Order %28PO .lzh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c882b66-c171-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RedLineStealer)", "timestamp": 1706840419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706840419, "uuid": "ef05c558-2d9c-4494-8bc5-d4f1f298376e", "comment": "Malware payload (RedLineStealer)", "value": "b1e9d6217f5d3302fa8a79622837a08e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706840419, "uuid": "8963a23f-b314-445a-aee5-c1aacbc91164", "comment": "Malware payload (RedLineStealer)", "value": "feda5a24df17723cab4f11cdb2563148f607d61500f177d7e622e0a5e6a3288c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706840419, "uuid": "86ecec06-56ba-4416-b0e3-940dcb772d5f", "comment": "Malware payload (RedLineStealer)", "value": "47483215bd91139dbfe83962a65e8bed231c7d1e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706840419, "uuid": "581f1e11-cc40-4fcd-9231-25777f37a7ba", "comment": "Malware payload (RedLineStealer)", "value": "922803b5df391a94e8b4933e12d2e524bb9ddf5f2a40b0f3a51181e6294e13b6017e48e6738545a497ebb330e5d4f5ac", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706840419, "uuid": "f13ae0e6-e825-447f-b447-b38cb9645c11", "value": "T13D464A503FCCD852F6AF79F2206580648166AC8D1B57520A66FAB63658F1383FC4B36F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706840419, "uuid": "e50b5aca-adec-4bf2-ab5a-d6857c1cea02", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706840419, "uuid": "5f2adaf3-aa8e-49df-8d7d-b4ad756c070e", "value": "49152:oEHTr6t0Ko9sk/IRUnhBkkr4vJjn4vjfDLDqks33As14st36:mt0v3EL5n4rfWx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706840419, "uuid": "23b51961-80b1-4c36-b799-0088bcc39458", "value": 5855232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706840419, "uuid": "867141ed-f214-4fe1-ba58-bce471aa5bda", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706840419, "uuid": "89cdb485-60e6-412b-bd23-99a1b8da4519", "value": "b1e9d6217f5d3302fa8a79622837a08e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24c43702-c17b-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Amadey)", "timestamp": 1706844513, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706844513, "uuid": "3f931f3d-010c-49a8-b45a-42470f8bd65f", "comment": "Malware payload (Amadey)", "value": "d467222c3bd563cb72fa49302f80b079", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706844513, "uuid": "e415dfe9-9ddc-4b10-a7fd-0263bac96c3f", "comment": "Malware payload (Amadey)", "value": "fedb08b3ec7034a15e9dee7ed4dec1a854fb78e74285e1ee05c90f9e9e4f8b3e", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706844513, "uuid": "1e4b6dae-5190-4166-8cb9-395eee8b9c19", "comment": "Malware payload (Amadey)", "value": "9335e2a36abb8309d8a2075faf78d66b968b2a91", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706844513, "uuid": "759ccb0b-f39b-4068-9aff-562afcd8c367", "comment": "Malware payload (Amadey)", "value": "bfae258f36462017b8ee3292069cd5364a00a8cd304ba09130945ba19dd28b6a58ffb2e64c4fddbfba35d6e20389c2e6", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706844513, "uuid": "88e8406d-6b17-4a91-9f72-dfc6267de1a0", "value": "T1DC947D207852D032C65192721E68FFF684EDB9219B7105CB77D44F7E9E212E26A31F3A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706844513, "uuid": "239088de-1551-4d62-9c5f-5e2ccb9215ec", "value": "7cb9aa2297e5fe3e1ffa772b481cce9b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706844513, "uuid": "7d4f235c-6f91-464f-a508-5e8c3f15d6bd", "value": "6144:0UorLrzMYSnDyTtDOYtf3J7+YZIPcrPJruPWeX2/e1Cw+GOpumhauZef6P5rwmx:0vcYZD17DMPWev1Cb3umhauZef6a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706844513, "uuid": "35dd9949-bf05-44da-94b7-bc9cf782ab8d", "value": 423424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706844513, "uuid": "58a1019c-06c5-4752-913d-2f4e8b947f1b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706844513, "uuid": "7af0776a-2a0b-45a2-becc-14c3ce397e9e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19d3e914-c1bb-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RiseProStealer)", "timestamp": 1706871983, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706871983, "uuid": "5adb84ef-e992-4a45-9607-15e1ab771861", "comment": "Malware payload (RiseProStealer)", "value": "c6abe1266c35494a6d917d4b5c7a511d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706871983, "uuid": "fea2f9f7-3015-4c30-924b-5730e58ce616", "comment": "Malware payload (RiseProStealer)", "value": "ff974573fdd859395f3e9fd808105a38390d1f99d4bb7655771c8ba7f8de3288", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706871983, "uuid": "33cb37cf-4182-4fb9-97a6-6e371bb13217", "comment": "Malware payload (RiseProStealer)", "value": "948c6a24869a62593c24889ec58d8da7c06fe8bb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706871983, "uuid": "c7c3017a-6b44-4657-be44-a3c1d9785945", "comment": "Malware payload (RiseProStealer)", "value": "fd4f542555a6412dd2b99e23f5b18b0f7548f5cf68d72369b83c92e14e80fa85a3063ee61589f7087e46c7c23af75e48", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706871983, "uuid": "fc68cc79-03a2-4685-aa1f-0dd1c3c21729", "value": "T1EEB533E7987A24B0C0B31FFDA25A1900712BAEB76498531D8457F84A87BD3790FDBE50", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706871983, "uuid": "4fba7b98-4b2d-452a-b5cb-22c886ffffe0", "value": "baa93d47220682c04d92f7797d9224ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706871983, "uuid": "602e2ee5-cdb7-4640-bcb5-77320a93bca6", "value": "49152:P/uZGVVDIDu1591g5KzmzGzug2IAeVRzYk3p1h8MiL8nXfut:nu8VVMqj5zmzGzuBDe0ktzP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706871983, "uuid": "e73dac3e-d29b-44ca-9e9c-c5fca9538143", "value": 2352128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706871983, "uuid": "eb990e83-3e6f-4f43-988c-cf68fc84f29d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706871983, "uuid": "f9846127-6f81-4c66-bf1b-731098d24b86", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }