{ "Event": { "published": true, "date": "2026-03-15", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2026-03-15", "timestamp": 1773619381, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "4bbc1254-d2c9-459f-be5d-52a98d9f9a8e", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36d86f1c-2036-11f1-a769-42010a9c0008", "comment": "Malware payload (NetWire)", "timestamp": 1773555264, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773555264, "uuid": "49faf88e-2dad-4064-ba6b-6b83d966261c", "comment": "Malware payload (NetWire)", "value": "6f492a9437819a4f664d456da5657068", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773555264, "uuid": "c70f9a79-5fad-4699-a9aa-1cecea4a991d", "comment": "Malware payload (NetWire)", "value": "00f01750994214b5d936755f4e67db0663fe9787960817e2bcb7b3c85e394f98", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773555264, "uuid": "ef538939-4ff6-44e7-be62-772c3daf5949", "comment": "Malware payload (NetWire)", "value": "8c5e9b1540011b0946aae58cbaa884148eba13d1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773555264, "uuid": "e9b79214-2480-42cd-9c36-bfc753f05bb9", "comment": "Malware payload (NetWire)", "value": "3ed7abc25a3a09ff6f5b12402ffb8fef514f3b021359ad30415c77bb3a672d07b4b86188c2c5ea65fb5fd402ee848336", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773555264, "uuid": "4f6f6115-f6ff-48c4-91a7-5d53840a3031", "value": "T19665BF52E38EC2F0DE165172BA7DF73A1E3B3C254530B9566FC5ED3AAD21021112DAA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773555264, "uuid": "d78d0015-4a5c-4f13-9983-c6feaa7c3338", "value": "dcbf4f6f0a66c4ef804fdb68720c8682", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773555264, "uuid": "1ff664aa-7454-4213-8c4e-f18d227ed3f3", "value": "24576:nu6J3xO0c+JY5UZ+XCHkGsoEAdx20W4njUprvVcC1f2o5RRfgdWYw:ho0c++OCokGs7Adgrd1f26RNYw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773555264, "uuid": "3e5609b3-bda8-4f30-b624-a1e6cad3fc12", "value": 1462026, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773555264, "uuid": "4b54b980-c649-4363-8ae9-b7aad6d34641", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773555264, "uuid": "1977ce77-5e23-411e-ac18-dbce0fc44bba", "value": "x00f01750.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d68af9a9-2034-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773554673, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773554673, "uuid": "67f19613-44d1-4119-aace-48cf9978276d", "comment": "Malware payload", "value": "58a3c9ada703dbf76297b30f543a9e2c", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "imo messenger", "colour": "#0EBFE1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773554673, "uuid": "00ce1593-c08b-4a30-9d1c-d78c3a1e13e9", "comment": "Malware payload", "value": "038ddeb937e70aa8e1321f55c5d43b18f4cea9dd6abe63f43141ec22ccbe9825", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "imo messenger", "colour": "#0EBFE1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773554673, "uuid": "73e1aae0-60bd-4658-94da-a002bcbcc0fd", "comment": "Malware payload", "value": "844bc5ea534de36318a87577c77f88adbbb08182", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "imo messenger", "colour": "#0EBFE1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773554673, "uuid": "8029c0f6-a103-4334-8a38-c06bb226f14a", "comment": "Malware payload", "value": "3aea217dff43d4d85d133ad84d577f8792004ccaac6456dccb4325826ebd4ff33ace7881679ce60d37b9b843ecc2964a", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "imo messenger", "colour": "#0EBFE1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773554673, "uuid": "38afbc1e-e7ce-4064-bea6-7295f4d7faf0", "value": "T174A533C9D510D008D8B66D707A24DB34F05E44C79A6EF90EE24F3D48DA4CAE6369CEAD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773554673, "uuid": "a257d871-eb6e-4a7e-b642-3a7783aee860", "value": "49152:TTlMoOEXHrbotk4qwhjdP9nfK1GYToJ6fG3YrJBh:Xj5Lb7tS9iGYTG4h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773554673, "uuid": "c34e3f3d-c3a3-45a1-aba1-d29f31524c0d", "value": 2180146, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773554673, "uuid": "412d9db0-6bc6-49e1-9b6b-1b5193d3f4fd", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773554673, "uuid": "6f1720a9-1b93-4423-a1ef-1cb9e0d18f12", "value": "imo.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d16ac1d-205f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773572857, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773572857, "uuid": "b937af9d-959f-45b2-8a31-5d94af77ab98", "comment": "Malware payload (Mirai)", "value": "ccfc8c9514b57e6c77cf1c85353b17ff", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "i686", "colour": "#720473", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773572857, "uuid": "0640d0b6-2a64-4e92-8ac2-73d0ac164f88", "comment": "Malware payload (Mirai)", "value": "03ad963eea94c31a01a79e26be253016c386e993ca092434b78fb9f5a70defbe", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "i686", "colour": "#720473", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773572857, "uuid": "f79dfe51-1732-4877-a3e5-9cd24a8902d7", "comment": "Malware payload (Mirai)", "value": "1c0464fdf4f5e2355fd33f3a0574f62ccc14a846", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "i686", "colour": "#720473", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773572857, "uuid": "6a25f236-2290-46f5-88b3-5f1b108734b9", "comment": "Malware payload (Mirai)", "value": "4b75c285a3cf8d546e4e6fe325e1ae688483adfbf6e323aa15588d7364c44076114f294fafb44cfff07e20e3aea5f47c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "i686", "colour": "#720473", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773572857, "uuid": "e2563000-f4d3-4f90-a87a-12b616798ade", "value": "T152F32B41F8CB89F6CD07497460ABF33FCA32D57A41369AA9EF949E71D627601010B39E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773572857, "uuid": "8a3a1adc-b7ca-438d-8e06-6f8dcf4085dc", "value": "3072:Al39PUmUy63eaZsfWcRkyFvrECNU90BsuuCfJJU8Dc/5C6:839PUmUy63ea2O4FvrECNw2e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773572857, "uuid": "80aa438a-51a8-448c-bcc1-86b0eb4992b3", "value": 165072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773572857, "uuid": "db224e50-a2be-4bf5-ad1e-a2f557a3d9c6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773572857, "uuid": "5dfe2996-8485-4bf5-866d-d74b71f4d99d", "value": "memory_load.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad4713ae-201b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773543866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773543866, "uuid": "78a510dc-2766-4142-b036-b17cbfbf481a", "comment": "Malware payload (Mirai)", "value": "9937a4ca32a0bddf91559276758924df", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773543866, "uuid": "7e1b905b-7c39-4203-b2ed-fff0426ed428", "comment": "Malware payload (Mirai)", "value": "047e5348b71f12cc9d6f1241f771a0be3591a348a8e9e556c99deeaeb68b1199", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773543866, "uuid": "524d89da-7af0-4742-b7ed-e10dd7466e26", "comment": "Malware payload (Mirai)", "value": "402eaee5cd97f904a2c90c3d4bbf1174c8c721c9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773543866, "uuid": "2da7a70f-e61d-464d-8b4f-d96268da6227", "comment": "Malware payload (Mirai)", "value": "8f93e4201690135c1e70240099b8eed007346fd4a6ec718ddefa261a1642877658539ab27ec317e853456f7147ac9f5c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773543866, "uuid": "df60d44c-7cb9-488e-97a9-f83f6bd31f48", "value": "T19B23F1104209EC72CE7649B6FD352D004BD96BFCA0E7B751533A85E8BF9109364CADC6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773543866, "uuid": "678d07e6-36e7-4cf6-9177-231e7429afcc", "value": "768:vv/83cUb8OjE50ghl8aY8R70v/r7cXluDRC3s3WL9q3UELIXzPa9h9JFcV0W:ChK505aYiYv/3+ok3+LIXzSHHq7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773543866, "uuid": "379a2aef-db2d-491f-9382-e77aed6a3d49", "value": 47200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773543866, "uuid": "464bbc11-cc7a-4bcd-870a-d993a4c68348", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773543866, "uuid": "7e2da1c1-8915-4542-9d21-93a14c110d79", "value": "charliekirk.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "838324b8-2043-11f1-a769-42010a9c0008", "comment": "Malware payload (DeerStealer)", "timestamp": 1773560976, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773560976, "uuid": "62f9e66e-a92e-459b-8639-db5b43358be1", "comment": "Malware payload (DeerStealer)", "value": "73e9ab1674c64f040da642b6a4690356", "object_relation": "md5", "Tag": [ { "name": "DeerStealer", "colour": "#892807", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rugmi", "colour": "#64B88F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773560976, "uuid": "201dd6f0-e4b7-46da-a2c0-e9d21465049b", "comment": "Malware payload (DeerStealer)", "value": "04bb4867d35e77e8e391f3829cf07a542a73815fc8be975a7733790d6e04243c", "object_relation": "sha256", "Tag": [ { "name": "DeerStealer", "colour": "#892807", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rugmi", "colour": "#64B88F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773560976, "uuid": "242589b4-80a6-4262-9580-4e77f4cd45b6", "comment": "Malware payload (DeerStealer)", "value": "e5a508bf8a7170cbacd6e6ab0259073a2a07b3cf", "object_relation": "sha1", "Tag": [ { "name": "DeerStealer", "colour": "#892807", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rugmi", "colour": "#64B88F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773560976, "uuid": "1a367b41-0911-4cc5-a258-b6de1ee667f1", "comment": "Malware payload (DeerStealer)", "value": "f92f35652f42f4bd2238d110cfd5a6ca3b46c1530277687f1926e3a8bf89e3dd115ec38818b5a09b828537b48c7c2158", "object_relation": "sha3-384", "Tag": [ { "name": "DeerStealer", "colour": "#892807", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rugmi", "colour": "#64B88F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773560976, "uuid": "88430f01-3237-4fef-b441-1dfec76a1308", "value": "T128E63332D5A54023EBF20272F96C66357DBCB33417608E2DE3D4AE5D2E688816777386", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773560976, "uuid": "11b242ad-8421-4c6d-aab2-2e952a85c36c", "value": "d7e2fd259780271687ffca462b9e69b7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773560976, "uuid": "53f5e702-df3e-4635-8fc0-e0e5f8c62be3", "value": "393216:sRjd6GMO8lRXCNqDGn+jb4J1eiHSrghCrd5lMwg1MZUqWQaJi:sRjd5qCIDR4JMvrwC55OwRJ2i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773560976, "uuid": "945e52d2-bd15-4523-a79d-1987de889449", "value": 14990585, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773560976, "uuid": "b6491a55-0998-40ea-9ed4-983d14146482", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773560976, "uuid": "e1bd7bc9-7675-49e1-b15e-472072074083", "value": "executable.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "048c3bca-2018-11f1-a769-42010a9c0008", "comment": "Malware payload (NetSupport)", "timestamp": 1773542295, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773542295, "uuid": "09a38f9e-f100-4994-90d2-d0f145f03f5c", "comment": "Malware payload (NetSupport)", "value": "106ce60666b35f494896120b6c1af9c2", "object_relation": "md5", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773542295, "uuid": "f11469e5-a985-47dd-89c9-95425dedb1e7", "comment": "Malware payload (NetSupport)", "value": "0501bed4067ea9365d6a6e553e4a709a9b5cb829a5a1d83bcf3a858e6505f353", "object_relation": "sha256", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773542295, "uuid": "4374a536-9f08-474f-b965-d765c3b02539", "comment": "Malware payload (NetSupport)", "value": "ab20ccc77e2bbb51c3c9e8745401fedf74f297b2", "object_relation": "sha1", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773542295, "uuid": "ed166152-0b79-4206-afbc-402fdb4394ec", "comment": "Malware payload (NetSupport)", "value": "c0a94c7fe00b74134a49928b2a04be3b425d710e4affeec1bd48355d518643e585158c5b4647b356d574a695abfe5244", "object_relation": "sha3-384", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773542295, "uuid": "6649d464-5e26-4bca-9eca-3f347957fcd7", "value": "T1F5F4237F53A907D3999697C14A008CC7FF7C8623697D4B18823B32ACD2247E8676D749", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773542295, "uuid": "bf1a9eed-121d-4b69-9047-ff71839249bc", "value": "12288:NG88bl2NvcPD7rGsCWV0wAqnYpvDpJvNdhQfC04GKLROxbHS1N+VfazHGB+bscG:/QiUr1CJPtJ1dhQfxuROR8N+xazHm+Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773542295, "uuid": "042fc7cd-f98c-4a46-8754-d01dc646c048", "value": 790914, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773542295, "uuid": "8591be6a-5506-4438-908b-35405c08d367", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773542295, "uuid": "636d9b0b-0325-45d4-bbd2-dddd895effcb", "value": "jr_verification_google.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9de43d14-2048-11f1-a769-42010a9c0008", "comment": "Malware payload (CoinMiner)", "timestamp": 1773563168, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773563168, "uuid": "b78c0af8-0a6a-4af1-97e8-ac3b2a8183a6", "comment": "Malware payload (CoinMiner)", "value": "54d37f09251cbe283f42f64964083ca8", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "RiskWare", "colour": "#8F06FF", "exportable": true, "hide_tag": false }, { "name": "SpyAgent", "colour": "#4243C2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773563168, "uuid": "5641f8f3-1a42-4ec8-bf9a-bcf9ebaaaef2", "comment": "Malware payload (CoinMiner)", "value": "0628ad6d1fd836b13b22e75fa169502d8ce78b7ad20f0261eb5151da98437bca", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "RiskWare", "colour": "#8F06FF", "exportable": true, "hide_tag": false }, { "name": "SpyAgent", "colour": "#4243C2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773563168, "uuid": "66024cd8-668f-4068-a2b6-6463fe141a9d", "comment": "Malware payload (CoinMiner)", "value": "5c9d9649b439b86cf18987865b32dab228ace037", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "RiskWare", "colour": "#8F06FF", "exportable": true, "hide_tag": false }, { "name": "SpyAgent", "colour": "#4243C2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773563168, "uuid": "96a01ffa-26f7-43e8-9a2e-4293f3829eca", "comment": "Malware payload (CoinMiner)", "value": "48eb88b456eff70b37c4668695f2fbd7c1571d7f6b680afb725079e02837d5380c9cd0ee465c548cf36a10028c84923a", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "RiskWare", "colour": "#8F06FF", "exportable": true, "hide_tag": false }, { "name": "SpyAgent", "colour": "#4243C2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773563168, "uuid": "cd5f0d29-19fb-488a-961a-101e04d7c01c", "value": "T18B472347FB84882BF4F753B241399761D44B4C668B439AC77A14353C28B7AD02F9AADC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773563168, "uuid": "fe6b498f-c6b0-4dc9-a07c-a19c91ea1bfa", "value": "786432:Qi4HkZXQEAj5xfQLOmf+MjT4HecyY2M/XxM:+HktQEQORfjT4YY2M/u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773563168, "uuid": "595fbb48-8917-4b92-8e15-698b865ab6bd", "value": 26053444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773563168, "uuid": "05d36938-7cbf-4172-a85a-0a21e8c6e5ba", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773563168, "uuid": "5cc59b12-decb-4588-ab35-4dff19f5270d", "value": "duanj.me.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e706386-2016-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773541533, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773541533, "uuid": "4fc13bba-03c5-47d4-bfff-0d50cfed12bb", "comment": "Malware payload (Mirai)", "value": "9274b2c141bca2ac2d938c127886f597", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773541533, "uuid": "72e3481c-ba70-42d5-8999-b1ddf5909e73", "comment": "Malware payload (Mirai)", "value": "080bed1a4b9a6a34911ac0a043e5138cc6801a326062b9ebfa4e3cd4ef57ec05", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773541533, "uuid": "9e77f8cf-e976-4b0f-aa30-bd42839bc6ff", "comment": "Malware payload (Mirai)", "value": "dbcca76db9ac405f2c9c787838b040b7c4010b1e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773541533, "uuid": "dec980ca-e7c8-4400-96c1-d9ae45e04cbe", "comment": "Malware payload (Mirai)", "value": "17e21324af57188a0633227336b541a33602ea4441ff8650e3e801d1d709846a5c1569abfd3d25de44b18aa711727fed", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773541533, "uuid": "4bf2375b-fae1-403a-83c1-0a830bfc847c", "value": "T15AE47D9CFE4E3C42E2D7E2789E4987E1721771E4D72391A33982434CD5CA9E9CBB1921", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773541533, "uuid": "dacccd8b-7bf2-4b78-afe6-71942f05716d", "value": "12288:ZWzWCsEKt0M9GbwV4qysOmfwTYiS77RV2EKug0XPw5dWMqMK:2GEKt3mqysOmoTYB/7d5nM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773541533, "uuid": "494c5691-854d-4df2-95e4-7202b578bf54", "value": 701712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773541533, "uuid": "0d1ba943-04ae-477a-b8bc-112a2dc849d2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773541533, "uuid": "db15f128-5d11-4c91-8727-585acfed020b", "value": "data.aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99df60bb-2043-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1773561014, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773561014, "uuid": "ddb99643-1a48-413e-bf75-4a1c81d26087", "comment": "Malware payload (ValleyRAT)", "value": "8a527df7abb2b6420ffe11d389c5ca8d", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773561014, "uuid": "7d056ca2-a9b1-45ad-9dcc-6c6d8f1762ec", "comment": "Malware payload (ValleyRAT)", "value": "085b5ab05e4901301f0912d7fa5220e22c7f7421db47def1484022afff34ba85", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773561014, "uuid": "89d63a71-6ef3-482a-88bc-e9dfe31e365f", "comment": "Malware payload (ValleyRAT)", "value": "3112db7b9bac17e6282dff1a320a99f09ff6c274", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773561014, "uuid": "5e14ce40-db17-4965-8083-1b25f767a750", "comment": "Malware payload (ValleyRAT)", "value": "04d2bf6c6447345de763190ba2cad3552b14efe1e57a1b55dfac766702347045bffe7248f2b56d04c7ebadf35a1c3e6b", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773561014, "uuid": "ba021667-5aa0-471e-b408-a33ef9ada7b3", "value": "T124047B417482C076DA7F1634087ADA656A3D79214FB09EFFB7D44E3E4F302C1AA31A66", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773561014, "uuid": "ddf0185c-95ff-48b4-9c4c-239b4d6d95b6", "value": "fdc6eb8758a17a36d2a26d07a088b984", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773561014, "uuid": "7cc71964-24fc-42e5-ab8e-ab91721fb0ab", "value": "3072:oAFKOIneiYz8ubhR23hxqHhYa2uUkgEXhwgiuAg0Ful5h/68rQJE:fBYu/Kq12ugkNAOFQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773561014, "uuid": "bde29b77-9e93-4a5c-b6f4-4b94001958e1", "value": 179712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773561014, "uuid": "539983be-eab1-4e2a-8b9a-50624dbcdacd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773561014, "uuid": "74b9e3f0-cc1a-4d08-83a9-8f9fc3595080", "value": "8A527DF7ABB2B6420FFE11D389C5CA8D.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1b96afb-209b-11f1-a769-42010a9c0008", "comment": "Malware payload (EternalRocks)", "timestamp": 1773598957, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773598957, "uuid": "a1fb4a6b-0780-4d0e-8fa8-0704025081b4", "comment": "Malware payload (EternalRocks)", "value": "e348631a2729a08a9790f2c85bffc9d9", "object_relation": "md5", "Tag": [ { "name": "EternalRocks", "colour": "#8EC11F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773598957, "uuid": "f6efb87c-2ed5-429b-b540-cb78a8289a49", "comment": "Malware payload (EternalRocks)", "value": "08bbca1e793987092b0fee110128e2c380a85bfa736263d4a29dd7f858383158", "object_relation": "sha256", "Tag": [ { "name": "EternalRocks", "colour": "#8EC11F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773598957, "uuid": "ea78dea7-3312-4b66-a048-cfaeaa9ab277", "comment": "Malware payload (EternalRocks)", "value": "6ba2c6da30a56bf978c0c5eee532354687c8dbfc", "object_relation": "sha1", "Tag": [ { "name": "EternalRocks", "colour": "#8EC11F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773598957, "uuid": "0b8cfa5d-5870-42ee-84b8-35d670bdafda", "comment": "Malware payload (EternalRocks)", "value": "788f6740f56fd90d684b941dccc0401fd53c8a8c3d2f95fe546de7733c77984724b928e240707f5aa2a9cc5c831715b5", "object_relation": "sha3-384", "Tag": [ { "name": "EternalRocks", "colour": "#8EC11F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773598957, "uuid": "dc459ce7-3640-4970-9f8f-b4d54f25a13e", "value": "T107854A00FEC754F2E8161B3255EB63AF2739980A0B36DAC7EB403A79B9776D10836355", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773598957, "uuid": "2ed546bc-f8e4-47a8-92a9-77cf05123ac7", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773598957, "uuid": "cdaac04c-fb55-4145-b503-becdad5c44a1", "value": "24576:yeBkKRegNVyQvLeV5BKoEzd9YpYM7RxaiDWr8jEevdMfTxJTM//p6gFCoNJs87vM:yjz+EcfwZdMfTxJTIhrNyEv3lv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773598957, "uuid": "15f34937-1871-4823-a420-556ae20bed73", "value": 1805312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773598957, "uuid": "bd0429c6-751f-4a06-a74c-36547ab49067", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773598957, "uuid": "37d8a3d1-12b0-4ff0-bc21-1f9a737f0b40", "value": "Installer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99455bcc-2076-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1773582917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773582917, "uuid": "297df965-4900-4bd1-b78e-de302dd5683c", "comment": "Malware payload (RemcosRAT)", "value": "db5d442c2b905a9da0104080935096ed", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773582917, "uuid": "1705fd78-afcf-4249-b4b2-9839a21c4e1d", "comment": "Malware payload (RemcosRAT)", "value": "0a4d85148ad5851b4db1fcd4337cad89d488151359dbdb98be518bff0e403cbd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773582917, "uuid": "db36325a-2a7e-4f3c-8680-8f21f69a84a7", "comment": "Malware payload (RemcosRAT)", "value": "24aebf001f3cfcc9baf58e79b308dac674ad857a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773582917, "uuid": "adc3e939-e0bc-4995-9854-e3dae7a84314", "comment": "Malware payload (RemcosRAT)", "value": "ccb144db1226d4f92c40df7115ad4b096cfb7a2ab4a4d3551827ee45a2a82d55157b0669a2152d483724a2b32acf20b4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773582917, "uuid": "e423e588-6817-48d1-8f56-8ebfcf3f8d9f", "value": "T18A84E102EAC191C2DC356A70C957857A25679E3894E00E477B6CB32F69B73815C2F3BE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773582917, "uuid": "5a6dd674-b1e8-4bbe-8004-228cb7a5dc9a", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773582917, "uuid": "411c9c1d-0c83-4537-ae2e-68300b06ed79", "value": "6144:z5lz/Zgm8JjEt/XIESrOyNJ6oVjkEsIF3KB7S1EuXq:NFo8/Xr67J6oV45r4EuXq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773582917, "uuid": "a957c15e-42bc-4e3b-af32-18af4153b957", "value": 391760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773582917, "uuid": "43715ab6-5024-48d6-adae-9939a937f68f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773582917, "uuid": "120574b4-e08c-491e-8eab-1634c3911482", "value": "Payment.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4320160e-20ca-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773618850, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773618850, "uuid": "951a87fa-be08-4b8e-ac1f-4ed40f4c7185", "comment": "Malware payload (Mirai)", "value": "56d9734b77765164ea5c1350d95ea279", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773618850, "uuid": "f6533204-d89f-4baa-bc28-e47c2c13056b", "comment": "Malware payload (Mirai)", "value": "0a5e69df99b3f50e722b5b3585a908ebf13f8905c321d3039cdece1e46ae5aeb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773618850, "uuid": "9c3b985c-2653-40cb-80dd-27d57fa6dfab", "comment": "Malware payload (Mirai)", "value": "645e9b32c1aba688e50a658e1460b1eb0095aee2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773618850, "uuid": "0dc9fe4a-eb81-4508-b404-5025efa45479", "comment": "Malware payload (Mirai)", "value": "071d580fcc38bb70a959c308d0ec3e862c3292f826c527b3e959b2ff998e9fed71faa748e6bd2bfcc2591c10da69eb96", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773618850, "uuid": "6cefdc8c-bc7b-4655-8ac1-62f9923cb82d", "value": "T104834BD7F410DDBDF80ED77B4463490AB131A39219831F3A639BB967BC321943966E82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773618850, "uuid": "79733448-aca9-4228-87db-4a778cefac0e", "value": "1536:mEOAoGHPZO5HqZWaDX+aZ8oyCsFTNHFFaWonzs6N2uAQJSYh2a4rsvg:mEOAZHP2qcaDX+aTyCsFJiW6zsKAYh2J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773618850, "uuid": "a1ba1e2d-1d42-4096-8b18-a89f24bbcb54", "value": 85804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773618850, "uuid": "68c5acc9-1b6c-43ee-a7f8-b1ebdf013fd2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773618850, "uuid": "bee538ed-2e77-4909-8d4f-4cdfeb01c072", "value": "pm68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d6244b8-2067-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773576481, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773576481, "uuid": "079690d7-518c-4953-a57a-239ed5378a1e", "comment": "Malware payload", "value": "2d3d79cad563f00dae9330bc5425bc4b", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773576481, "uuid": "8ad5340e-1b26-44f6-ac9e-4cf18ff41e28", "comment": "Malware payload", "value": "0f335a8feef756b240a6290108c74c69be1c8caae34725c5c66ef8066276310e", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773576481, "uuid": "c63fffcf-7fb7-4334-990a-69af7dee5aff", "comment": "Malware payload", "value": "ccfc2e3bd34c092bd26da3681d5304a9e02df9bb", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773576481, "uuid": "1ccab833-0c9e-4e10-aed3-77d26cf9e854", "comment": "Malware payload", "value": "34f844e501e8ff1d30e42d622f749c9d650c2a613112fa0518d76f667c409c6b6e608c85a367549a09197f4715cecb97", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773576481, "uuid": "bd8865da-a315-4e3f-b5eb-9d1f35e55c2b", "value": "T1F6925CB512896C79FBD1CE399F3C7F4CADE882C42124E3ACBA4F39215A1166DC70535A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773576481, "uuid": "d47cd3de-bd44-4cda-a2f4-e3c40f848c2b", "value": "384:WFcuQpWx+BL0SWL0gZzsO9a4cbddrME8jyfzsO9a4cbddrME8jy4:WF8i+BL0SI06zsP4cbddr7zsP4cbddrk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773576481, "uuid": "0f40f016-4d55-4c59-a3de-8cc1491c0260", "value": 19499, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773576481, "uuid": "1c23b9a6-13f0-4045-aa27-2282f736012a", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773576481, "uuid": "65e4fe44-9c1f-4df1-9c3d-66aa09c1b7f6", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "602aa700-209c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773599142, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773599142, "uuid": "0f99f937-146d-4c98-ba9e-4f30c0664d75", "comment": "Malware payload", "value": "ca4ee495c6379a4ff50479c30fd899aa", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773599142, "uuid": "7d674884-e2c8-41f8-80f7-d602dc15acd3", "comment": "Malware payload", "value": "0f79989912572a24ba13baabb32b3fd084496271c51448d47b66fe1aedbf293c", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773599142, "uuid": "c382e7ef-fe7d-4073-a02b-62c02e99e1d8", "comment": "Malware payload", "value": "bb3e69e8bd93bbacbb648eb7d18166be2ac836f8", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773599142, "uuid": "3f81068b-9878-4f85-ad79-d1d058aacd63", "comment": "Malware payload", "value": "cd1d0ad68b950ff5f457bd9ff68c41622af36e66543830667733af16742bf00979a72d3302af7ef22ce25f05edf4e71a", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773599142, "uuid": "ee05f405-98bc-4f04-9fba-c8c619d4a928", "value": "T19E91D8975F357B3A87CEA6A1B03F480560AED56C4D44C508BF3E3D0E528AB8065A3F72", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773599142, "uuid": "3520a4bd-bdf5-41b0-a590-f9eb9ebf2912", "value": "96:tdtTDhdcKJ3cHhB8kvzNgp5VV7tD7uEpbEsCBezEgydH:tDXjfJ3cPHGpRt/pdzEgydH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773599142, "uuid": "40157cee-97ef-4818-b067-c16d2b85ebf1", "value": 4407, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773599142, "uuid": "c3428e7a-0b15-4033-899e-9865a16038d0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773599142, "uuid": "071efaf5-e942-454c-ba3d-414aa4524a6f", "value": "stage1_decrypted_wave2_0f7998991257.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45187df5-20ca-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773618853, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773618853, "uuid": "56c4562c-b493-40b3-8521-5ffd08cf881e", "comment": "Malware payload (Mirai)", "value": "e127e0b2c3307d6fe16e0567d30325fa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773618853, "uuid": "b1038f42-332f-4994-a387-0c4f8dacccbf", "comment": "Malware payload (Mirai)", "value": "104b23c56244946f13b005b2c10131377b3a1018c48dcb13d3399cced73bd1bf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773618853, "uuid": "156a566e-7442-4220-984f-279b37dbbf74", "comment": "Malware payload (Mirai)", "value": "4e4409bdac201a9dc65475371ccc4b2491596424", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773618853, "uuid": "597e745c-4de6-4905-a9a0-0f69266c9399", "comment": "Malware payload (Mirai)", "value": "30f14f9fd3710e4a0c708adc948a207bdd5cac929e35c8e3714b90de4c3b06b9ac3e8770205f0fea3d839b06b42653c2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773618853, "uuid": "06f04d68-d09d-45f2-ab00-5ece767492fa", "value": "T1C1F2E14431C2CD92CCF5C673AFB98204E16A5C74D9D832331EA09725AD16A94B5FD7E3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773618853, "uuid": "31a8a45b-eca3-46fd-904e-2aa8fa0c27c5", "value": "768:1EqwanU+dRP2QDd4ZvDI//2ahl+ejreBXHm/xxRfdZns3UozI:1ENaUSR9DWra+4P/eBqfnazI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773618853, "uuid": "8c98dea8-af7f-4bc1-b105-4e088d901e86", "value": 37480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773618853, "uuid": "0ca06443-c1c4-44bd-abf3-34e679cd0351", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773618853, "uuid": "a65aec09-d797-4874-8f6b-2ff5684c04d6", "value": "parm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eea21391-204f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773566310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773566310, "uuid": "6a7bcaaf-b163-4751-b71c-ff5541487c79", "comment": "Malware payload", "value": "d823fd908e16a5f847d488915930d5a8", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773566310, "uuid": "ddaa9008-36a1-46b2-899d-1a1da581f020", "comment": "Malware payload", "value": "11e04cc6fbf454ae42ae639df328f22b209529d229536c6b5ec949452ec35496", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773566310, "uuid": "4773b129-1d96-4a39-b778-0d456a3ac1ee", "comment": "Malware payload", "value": "0f795393d9283121a90c4403f3ed8cac0df50a25", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773566310, "uuid": "a06cc1cd-9662-4582-b496-06d868bb874c", "comment": "Malware payload", "value": "af8415be99c0f207e0490949744564348cd6d80d82e3e59ad064ebf95f19a91a40d3888280b5bc7c097e05e0a16f97c8", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773566310, "uuid": "36742e26-972e-4fd9-9092-464bf93216f2", "value": "T129C3F24E21AB607107432B559AD7605FEF7427924660C3807B5CEEA4BF90FE190FB3A9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773566310, "uuid": "f5dbdacf-1931-4121-ba8b-3cd01914184b", "value": "768:Tk1cIc4EZRsosMps6Dzpi0VrmmlFqI+yxaZ+CIhXkR/d5NwzqVMFaCQ42C8OOBW4:oHcZZRTraZ+CIqwzHVQ42TrHZFZGVWD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773566310, "uuid": "b6a96cf9-3a9e-4388-8963-ee845e3470f0", "value": 119952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773566310, "uuid": "467789a0-7f4f-4848-ab20-8c4f7bdf1284", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773566310, "uuid": "31b98b34-a5d3-4ded-add2-a5f6bd7a7989", "value": "Omega_Summary_Europe_6907.jpg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70a1cce0-20ca-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773618927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773618927, "uuid": "0d84703e-d226-41bf-a39a-6c13ac164b8e", "comment": "Malware payload", "value": "21764afd3032a1e24a7dc2e084b7ae3a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773618927, "uuid": "b4347ac5-339f-4eb3-9a13-ffbd4a9b4fdb", "comment": "Malware payload", "value": "11e23e65af82f9567e8c04dabce0b6f6cb09c1f0a3e0c1782d4ab121d39bfd50", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773618927, "uuid": "0bf751e6-4f0f-4f3a-b59c-9c1d327b225f", "comment": "Malware payload", "value": "023f67cf2b68793112310cc53d57b3800b2d6c51", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773618927, "uuid": "dabf7d53-726f-48af-bad6-e652748035e1", "comment": "Malware payload", "value": "221ce754dec070461626017fa00b76e07a9518d43d03c899c03c7c18f0af1738a0e636a8b578e7eb277953b4a7e9de86", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773618927, "uuid": "87a6a215-e597-4c0a-8439-5fc5fcd8182b", "value": "T171A606EB76E78568C15D823AC09E8B4184F372B71777C1EB729007A88A3E5CC5D7E921", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773618927, "uuid": "18101228-6b13-47d0-a90a-88f626d42f8d", "value": "b8399aa8e7b34c992334ad63f681f404", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773618927, "uuid": "92e9f25e-0533-4b27-975e-ab459ca30a14", "value": "49152:d3BDMNyKXcTCa1C7hoaeKEvj995SA50moXGQRdReVTV8zXtdF6UYWUjfk/Jt4qmf:6Z9egRS5YMf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773618927, "uuid": "fae88304-9026-421a-91d1-40057b3184f8", "value": 10191872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773618927, "uuid": "020f0838-26ea-49ff-9163-865634704f40", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773618927, "uuid": "0faf7399-955d-4f11-af0a-c382bdff87c3", "value": "SecuriteInfo.com.Win64.MalwareX-gen.86531112", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1109b99c-2044-11f1-a769-42010a9c0008", "comment": "Malware payload (UmbralStealer)", "timestamp": 1773561214, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773561214, "uuid": "931f89db-a438-4a7c-ac85-6e4d2047161b", "comment": "Malware payload (UmbralStealer)", "value": "a0983563c6e1cf1867443f0064223438", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UmbralStealer", "colour": "#187523", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773561214, "uuid": "df584396-12d7-47fa-98aa-7a3a18101f83", "comment": "Malware payload (UmbralStealer)", "value": "11f438106b158e452816727b295430749a2fac639e116c14eb74d2071964d156", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UmbralStealer", "colour": "#187523", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773561214, "uuid": "6f9a52fe-8bdb-42b1-846d-731316a345f7", "comment": "Malware payload (UmbralStealer)", "value": "1a421ebe7bef49bb865ba049b52cf0d985091a08", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UmbralStealer", "colour": "#187523", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773561214, "uuid": "ce0d5c2f-43b3-40be-b885-b0f5a0325dbb", "comment": "Malware payload (UmbralStealer)", "value": "6cef18da2d263248b023f481cd94e88533184b9894e248278d41158f3f7789a6abbdfe5d53798407aa4ee22ef1bd610e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UmbralStealer", "colour": "#187523", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773561214, "uuid": "054bb20c-7f4b-4ea6-a6ea-2af7735b7556", "value": "T1D2D44B8067F89A12F2BF6FB96AB0455E4B72F403EDA1F74E188851DA15B3F90D850723", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773561214, "uuid": "740b1151-1e18-4c11-be29-1055a624276f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773561214, "uuid": "dbffc834-3a79-4cc9-967a-b9d75f3bdeb4", "value": "12288:9puxy9Qp+kSMf9ehDz5jZsdpYbNXpWjY3OXARhJ0g:9pdm9ehDzhhsSZR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773561214, "uuid": "2371cd95-fc23-4506-9443-072264bbc1b1", "value": 625152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773561214, "uuid": "92972660-8aaf-41f4-8b0f-aba0ade47829", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773561214, "uuid": "cb27307f-b019-47f6-a72f-9d0221e0e18d", "value": "Payload.exe.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4d0b892-2028-11f1-a769-42010a9c0008", "comment": "Malware payload (RustyStealer)", "timestamp": 1773549436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773549436, "uuid": "fe7e52d6-7977-4873-840e-df6882848e70", "comment": "Malware payload (RustyStealer)", "value": "0761c3a35cd645552b3dccc7ae66de6a", "object_relation": "md5", "Tag": [ { "name": "pw-2026", "colour": "#4CE282", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773549436, "uuid": "7200d606-da1d-4a4a-9670-6fe4537af121", "comment": "Malware payload (RustyStealer)", "value": "12b3cfb959b03997387e60e9fc4e7aa1ed59ed811cb0770347f29ec2f779ea3a", "object_relation": "sha256", "Tag": [ { "name": "pw-2026", "colour": "#4CE282", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773549436, "uuid": "d5be8ec2-8532-4895-bef4-e546c3a8b315", "comment": "Malware payload (RustyStealer)", "value": "9c0902d211b25f6a6445c27a2455d340f49bafc3", "object_relation": "sha1", "Tag": [ { "name": "pw-2026", "colour": "#4CE282", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773549436, "uuid": "cdfe89a1-d755-424d-9f69-3daac526bc04", "comment": "Malware payload (RustyStealer)", "value": "65d4a6dc72319aeb0f2eef229da4f6a00d48d43b09441ae80931919cea9ab59366b9aacf32805fab004cedfc55cb9bcf", "object_relation": "sha3-384", "Tag": [ { "name": "pw-2026", "colour": "#4CE282", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773549436, "uuid": "0fd02026-fb5d-4656-a966-b51c69948517", "value": "T1DAC633043AB87BD92F8764F2405B49F2AD10E53A7B1D0ADFD46427FCA327248D347A99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773549436, "uuid": "280b8ff7-0637-4cf2-932c-d4011bf210e5", "value": "196608:fTUDyDI54yl0z7L0Gu9kY+mD07LDtHUqY7Gft6IJMMnp:fTUDr2z7LDaox2OoPMp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773549436, "uuid": "1e5c6a14-c0f0-49e5-b5a6-fdbe72809139", "value": 11507609, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773549436, "uuid": "ace481b0-f72a-4ef5-84b9-2bced0b9e989", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773549436, "uuid": "e6c470a5-c696-44aa-b025-01e92fa551c1", "value": "WarLauncher.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a47c959a-20a7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773603981, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773603981, "uuid": "2ce7d706-4d5d-408d-ae84-8975027dd128", "comment": "Malware payload", "value": "cbf38082fcc1a92a366d2e43f68bfd84", "object_relation": "md5", "Tag": [ { "name": "77-91-96-218", "colour": "#6C3387", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "NotebookLM", "colour": "#E60DED", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773603981, "uuid": "682f81a3-3105-4e48-aaa4-0b8971953b35", "comment": "Malware payload", "value": "12b5974782289e6aaadf2df8088499792d79ab91325d4abc57b0383b94d67439", "object_relation": "sha256", "Tag": [ { "name": "77-91-96-218", "colour": "#6C3387", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "NotebookLM", "colour": "#E60DED", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773603981, "uuid": "6631344b-dadd-4243-b457-5ee816fdd4e7", "comment": "Malware payload", "value": "2bbc5497a86548424e1a5e7af11e13774ad0d9ff", "object_relation": "sha1", "Tag": [ { "name": "77-91-96-218", "colour": "#6C3387", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "NotebookLM", "colour": "#E60DED", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773603981, "uuid": "80ef7e25-e13c-4f4e-a4b2-31bf93bb4dfd", "comment": "Malware payload", "value": "1f5431611a5c17ce4f0ca80bb186a753717c309b0811e131361c80b33cba8ef5b45373571baffd9a9542e6e736235c09", "object_relation": "sha3-384", "Tag": [ { "name": "77-91-96-218", "colour": "#6C3387", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "NotebookLM", "colour": "#E60DED", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773603981, "uuid": "068467a4-7fce-4c37-93ce-f8a5371ee992", "value": "T189F66A93A7881BE8EA549CDD028C796B50F7C57B3C26219DDAE20723B43DF59BC54A30", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773603981, "uuid": "340d11ef-1eac-4032-aab0-fb3e0be4dce5", "value": "24576:s4+gqKAZenIysBq+ro6ECz+f+nVSES6NOP+R+l+6wA+Pqui+c3:7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773603981, "uuid": "fcb91885-fbd3-4b3d-86ea-48bd826b7c54", "value": 15622013, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773603981, "uuid": "acc571d6-2329-4ff7-9aa1-2481a4aa0383", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773603981, "uuid": "10dba870-97a1-4e3f-9e25-86e346a53769", "value": "notebk-91267b64-989f-49b4-89b4-984e0154d4d5.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "baea7e20-208c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773592422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773592422, "uuid": "362b398f-e159-4744-b8d0-4ab398771175", "comment": "Malware payload (Mirai)", "value": "9660898fd5caf03789bade360ba4d93c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773592422, "uuid": "0fafaa7c-2d3d-4b27-9f82-8d975e70781c", "comment": "Malware payload (Mirai)", "value": "14a0b845ea687cd69b400ca8aabbd1f0dea6d42db30ccc0eed2e815b4a18b8a0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773592422, "uuid": "da6f8d4b-d119-4ee1-9769-89a99c84b6c7", "comment": "Malware payload (Mirai)", "value": "52c0dc546148e425a5157d9f929ad694e965bd9a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773592422, "uuid": "065f5e07-7466-43a1-971d-eda04b4133da", "comment": "Malware payload (Mirai)", "value": "3b579b7462f0278c6b02ba46d2f73a24dbf1e8436a248a7d3d296137d25c6cdea96e3f95dfdbfe621829a565193e6cc9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773592422, "uuid": "2703a7d4-778d-40ea-86e6-cd077fd1d8a2", "value": "T144E36C8A6A83E1F5DC1547B830ABDF329AB7E57B2126DBC5D3B45D32AC1520184073BE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773592422, "uuid": "62833965-e789-42a0-94ea-ea5c813a4c19", "value": "3072:5N3tqx2gBLXcqxOrxdsbCmtl8Eo3jWwg7pxKPCH7Vcasg4iL6oPBASTHykQDs/5c:X3to2gZXcqMrxds3JDmoPZ2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773592422, "uuid": "91556b5c-23cf-4abd-8153-c0c92174ee50", "value": 152784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773592422, "uuid": "0c44a5a8-e976-4ffa-a378-b89b93d51e64", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773592422, "uuid": "90e72322-c135-475a-a3da-eda2ac4460ae", "value": "memory_load.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e9c34df-203e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773558713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773558713, "uuid": "67cafb60-3712-4c3e-9060-cad86f3b473c", "comment": "Malware payload", "value": "32dfc15fb09d731eff6303c2121c6f5f", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Goi", "colour": "#A81DA4", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "mparivahan", "colour": "#29C0BD", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773558713, "uuid": "921957f7-a419-47a0-9b2c-0102af44ef44", "comment": "Malware payload", "value": "1bf9c16cb7c1faae7fa99a57c5d091cbd1e6d5f3c0d79693a3b0990a8b58367d", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Goi", "colour": "#A81DA4", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "mparivahan", "colour": "#29C0BD", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773558713, "uuid": "6857972a-a1f2-41ae-bac0-42caa56c8c96", "comment": "Malware payload", "value": "ecc9953923cf01c1a2cabebfd21aa0e27403d7c3", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Goi", "colour": "#A81DA4", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "mparivahan", "colour": "#29C0BD", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773558713, "uuid": "7ea5bedd-1562-4bf6-9b46-4adddadc4551", "comment": "Malware payload", "value": "31ae775b5f50a13446b36a7dccdb1061e0c0d064e91115ea3e8330f87059ee34590fa726308a1b1d0f1eb798a9edd1bd", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Goi", "colour": "#A81DA4", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "mparivahan", "colour": "#29C0BD", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773558713, "uuid": "7a388289-8123-4bc4-a6f6-97c1d96966b7", "value": "T19046F150EF9D68DFEC3191F92A9E962139814D708BC27303DC6C7B9C5A337D96E84982", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773558713, "uuid": "8688112c-b655-495a-90f1-63c738c0af38", "value": "98304:gE/F6xYqlO0IHUgqTLs0aeH+Wjtqe0W5UHUUXfSX9Bd1vTI54L:gE/F6xYqk9SayeSXzd1OQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773558713, "uuid": "04f7b5dc-fce8-45c2-8c64-67b43a5089e0", "value": 5432419, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773558713, "uuid": "c4999d94-8bba-4ffd-8f09-3eca5f88db0d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773558713, "uuid": "f53523e3-ed92-4ad0-9e0c-2512f3b6c740", "value": "mParivhaan 3.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "501d0d54-207d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773585801, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773585801, "uuid": "d2a636c2-4325-4e55-9c5c-339d2ac07d99", "comment": "Malware payload", "value": "dc6864acf8d07dc390931b8e480cdf09", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773585801, "uuid": "5ef628d8-712f-4c85-b626-1897b29dc45a", "comment": "Malware payload", "value": "1d517dc55a1038003107fa57101266d59a93e272af35b56ca91ad284bcb2ebfd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773585801, "uuid": "407704bf-4f23-4ad3-940d-b7ad0343d3be", "comment": "Malware payload", "value": "9e491b367b32d90f1999679fca40c47803515b45", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773585801, "uuid": "025f0256-cfeb-4b36-9a7d-221996c80e11", "comment": "Malware payload", "value": "af5ea32fa5778080860c7c515cb3a25997f81600718233eaf92b7fffc845a7d8ee37cb181926d68c195a5d7259f252b4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773585801, "uuid": "ea5ea3f1-0841-43a3-9025-d7d87cd9b64a", "value": "T1D0B5D739BFE9C5A1EC9F5A349C78E3D42A67B8211D24A01F545B33CE0F76A519C60B32", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773585801, "uuid": "be03f3b1-f67c-4eb4-9fb2-a18618fd6026", "value": "6313a99fffecb8759e5b2f8e8aff2a59", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773585801, "uuid": "e30372e7-bcfe-4212-aa2e-0d7594920ada", "value": "49152:JoO6qko5mVUS3Xr9aI6BB6GwyvZNVeA4i:L6qkzwwSA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773585801, "uuid": "402b7468-8009-4908-ae6a-c660c36172b2", "value": 2371408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773585801, "uuid": "e36dda81-fc30-4ee4-b0bb-0a2fd12fc220", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773585801, "uuid": "4c32b2bc-c973-419c-b090-cc22849787bf", "value": "1d517dc55a1038003107fa57101266d59a93e272af35b56ca91ad284bcb2ebfd.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2447f883-2044-11f1-a769-42010a9c0008", "comment": "Malware payload (NetWire)", "timestamp": 1773561246, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773561246, "uuid": "753b3bf2-a84b-49b3-8f9c-1fdb3fa14f3c", "comment": "Malware payload (NetWire)", "value": "b3de24feb2c5a541362f11f15a169477", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773561246, "uuid": "e3d5f43d-945a-4aea-94f3-6d3f03b5a4de", "comment": "Malware payload (NetWire)", "value": "1d546c58ff8f2d922175cf534b153cf6364ab25a2030814ea74f2de07a8c653e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773561246, "uuid": "428a8eef-eada-4c2b-975e-6ce35234014e", "comment": "Malware payload (NetWire)", "value": "e65a5c1012f0dec98fc2090df9facbe0152d8d71", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773561246, "uuid": "5f488392-dabe-45ef-a92d-044f9156072a", "comment": "Malware payload (NetWire)", "value": "75936803433d49d665dbbf5c17ed373a87e666f475117804bf6d6a2c498072870a77ec13cf006bb5251765135491997e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773561246, "uuid": "5c2ebf8a-c9eb-4a2b-a4fb-86e4b758be79", "value": "T10D65BF52E38EC2F0DE165172BA7DF73A1E3B3C254530B9566FC5ED3AAD21021112DAA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773561246, "uuid": "333a945b-4e0f-4686-a762-7bf560d6578e", "value": "dcbf4f6f0a66c4ef804fdb68720c8682", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773561246, "uuid": "78e2701b-78c4-41e7-9a4a-294558ba538c", "value": "24576:nu6J3xO0c+JY5UZ+XCHkGsoEAdx20W4njUprvVcC1f2o5RRfgdWYq:ho0c++OCokGs7Adgrd1f26RNYq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773561246, "uuid": "f7c63315-f554-4e85-a388-994fd38ac5e6", "value": 1461106, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773561246, "uuid": "183f789f-a8ce-42e9-8e32-67e425d9920b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773561246, "uuid": "4e354e46-f274-42f4-add4-e5f8a2ba2479", "value": "1d546c58ff8f2d92.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08144e90-202f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773552179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773552179, "uuid": "efbbeace-ea2d-45e4-b15f-0d7fe894dc84", "comment": "Malware payload", "value": "7c355d63ef956270805e2110f5004cd7", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "Instagram", "colour": "#0E19E8", "exportable": true, "hide_tag": false }, { "name": "RiskWare", "colour": "#8F06FF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773552179, "uuid": "7bf036ec-fb55-4817-8c0b-e84fad891e5d", "comment": "Malware payload", "value": "1daf7482d700536bc5dfe45c763dad99123e41f0be205415d708b70e6dcbfbb2", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "Instagram", "colour": "#0E19E8", "exportable": true, "hide_tag": false }, { "name": "RiskWare", "colour": "#8F06FF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773552179, "uuid": "4c691b6c-d96b-4259-a8ce-774b35b6b990", "comment": "Malware payload", "value": "b64814856a29eb8baa602e95b8227a8f127c0c38", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "Instagram", "colour": "#0E19E8", "exportable": true, "hide_tag": false }, { "name": "RiskWare", "colour": "#8F06FF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773552179, "uuid": "f10a581f-1227-4fc0-8d95-d2c672d0878a", "comment": "Malware payload", "value": "fa7ad922fd1ac1a3a207169edede8c95cf5f9568c94c3f34e349d5dc08f70ca52b96fdfb147c6af0d7d2d5311ce2c291", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "Instagram", "colour": "#0E19E8", "exportable": true, "hide_tag": false }, { "name": "RiskWare", "colour": "#8F06FF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773552179, "uuid": "72e0fa0f-bbb4-4d54-9ef2-de423679e901", "value": "T18B281292D3AEBC29D5F39B35C7B110F7A9194D90CA73E7265246B0784AF39C0DA41CCA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773552179, "uuid": "94fc9500-962a-4956-9331-f11ea815504c", "value": "1572864:dT3qMKDXqo7ptg1SESDoktlj1gQ+t5APihhSB5RMq9r86Yp/hdmI4tl3m:dHKjqobg7S3ljiQ+tVuyq9r8//hc52", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773552179, "uuid": "a1b0bd67-764a-4380-a4f8-e2385a68c06d", "value": 94594528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773552179, "uuid": "42cdb93c-9a1c-4b63-b64b-fe7e366e61e9", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773552179, "uuid": "cc97d54b-a537-45bf-8310-b706a13c46ed", "value": "Insta-Pro-2-v11.99-instapro2.org.pk.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39d17401-2054-11f1-a769-42010a9c0008", "comment": "Malware payload (CoinMiner)", "timestamp": 1773568154, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773568154, "uuid": "432ff69f-2380-4106-8cf7-dd2fb9c4a75b", "comment": "Malware payload (CoinMiner)", "value": "95bdf27b3d312331e2ccf492880f248e", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773568154, "uuid": "3f2f6e0b-43dd-48dc-a167-41a7a6304f6d", "comment": "Malware payload (CoinMiner)", "value": "1e10f4ef73bf8bc6f44fc4a8d9fff8ee5cca834049e46e79c0c524a5e371cb9e", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773568154, "uuid": "f4ba0ead-f836-4b4f-a2e3-33dad38997d4", "comment": "Malware payload (CoinMiner)", "value": "4045c058ec80ab383426cc2abd3ca9b486401aab", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773568154, "uuid": "b5dd2574-0bae-48e8-888f-3ce35c9a0a9e", "comment": "Malware payload (CoinMiner)", "value": "b393ef8541ca51e317d6e1250205c5e2038550b6511409eea9de04983a39d283071702d0b2356b4dea2992f9031f710e", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773568154, "uuid": "3d384a22-2364-4734-a2f8-4f3235ef396a", "value": "T1B6176C8111F528E6E463873445FECD718572BDEA701C809E1095FE9F79B2B025E2AB3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773568154, "uuid": "43e3db30-9c60-4c6b-82a3-1ba85f03d940", "value": "14ad8c8a3b974abb2786cc7699d07458", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773568154, "uuid": "e2c78080-b3af-4361-ac12-e22cfa457da2", "value": "196608:VGFcpLDDOjwEin9hyVpB28/5pOkwITAZMVHh91huSSZGRlN:KcpnOjZiLk5jPTAZMVHh91huSSMRT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773568154, "uuid": "4d8a6afd-ab54-4695-b261-91a5f01e6410", "value": 18678272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773568154, "uuid": "17720ee3-bfda-4c48-bb91-571c3e71e6c7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773568154, "uuid": "e04ca666-720a-4afb-a88c-8ed521a3fc47", "value": "cabservices.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c03f7dae-208c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773592431, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773592431, "uuid": "cb2739ca-6fcf-437c-b6d3-c88dcd052b99", "comment": "Malware payload (Mirai)", "value": "4b436daa4d3c7ee382e452ca3e7c26e5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773592431, "uuid": "0124a73b-cd8a-485d-bd66-de19f23a2158", "comment": "Malware payload (Mirai)", "value": "20043bc60fff2c48c83683e8cda2f4c4190d6d0848ff0f36499f0f0a97d0fc08", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773592431, "uuid": "426968d5-3242-40e8-820c-687e6f1b6512", "comment": "Malware payload (Mirai)", "value": "d6b8c7bb7bf8b763fe010e92d1e177b99997b0d9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773592431, "uuid": "b0d0f809-f29c-44dc-b343-6325d250a984", "comment": "Malware payload (Mirai)", "value": "2d74b9484054f32bc2941b2c730dfc298025dee2c29002778dcc50aeab793275a2f482776b405c77b8287ae77d5b3d33", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773592431, "uuid": "30e2ad65-d163-41f0-adeb-9d4a04bbe5f7", "value": "T1A9F35C42754040FEC08AE5781ABF6A36C935B4BD1335B5AF23D0BE2B7C59E705B2E249", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773592431, "uuid": "04f151ed-8234-4f95-86b8-186e5706c6de", "value": "3072:RgSBj4XgZOAnD53MwZvaLCP+DZ7A0z0GLdsxTgWLArKko5qjOf5i6:RgSBj4XgZOAndN5uCP+DZ7AeJJSh8I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773592431, "uuid": "f76c41ea-46bc-432d-a78d-d643f9c9fa8c", "value": 161728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773592431, "uuid": "1abfd905-a1dc-4c13-ad5e-d9cec69fe9e6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773592431, "uuid": "39ed6044-07bb-4b42-b592-c0e857f4d895", "value": "memory_load.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ddc4735-20ca-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1773618922, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773618922, "uuid": "ce3b5cc7-4b8c-4413-a84e-9b396a4b30c0", "comment": "Malware payload (ACRStealer)", "value": "c2a0052c74e37562a8966fdd08aca0b7", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773618922, "uuid": "be9f992e-9148-4e62-abd5-b50bc249505b", "comment": "Malware payload (ACRStealer)", "value": "204108aa3133bc549454fccbc2aa081b0e1f4d5964ad3a6d5c32a7c25c255af3", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773618922, "uuid": "91262eb7-3a94-472c-9d0e-a8e797306c75", "comment": "Malware payload (ACRStealer)", "value": "29915a2f479c5ef3246a7f2c1eb0c37dcba0c79b", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773618922, "uuid": "4d06d451-f252-4146-8dc7-b0ece19765a5", "comment": "Malware payload (ACRStealer)", "value": "540db3eee911c5f9d0428bd1cd9c0e9dd15e9e67f7e6216a5f9462f7ef2fd35273ac3b1e507d65ce8337625420d8209b", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773618922, "uuid": "11f0ced6-2c3e-459b-9416-3d7841b176d1", "value": "T19B451A4A82C418E3D2930177290AE6927F7A064416BBCC26B1FD91EE7797DFC53BB490", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773618922, "uuid": "72005dab-b524-43fd-bb15-276e5391f4da", "value": "e525932ca67a9efe67ace2d54a87611a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773618922, "uuid": "15810594-2eaf-4942-869c-debd7375f8d0", "value": "12288:nasB0nAG/pvDoVgLnhovGeDT453Lrn70nljTnpLljLi6R18LmLDGLY0LOaLHGL3E:naXnvBeDs53vky", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773618922, "uuid": "2e7f5934-1c43-4bf1-92fd-c838d92d0c1c", "value": 1221120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773618922, "uuid": "808fc807-83e5-42a3-a6b1-b2b37be2e4d3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773618922, "uuid": "e3117264-d746-4639-acdd-fd2e7f9ff209", "value": "SecuriteInfo.com.Win32.MalwareX-gen.96216414", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f6864c7-205a-11f1-a769-42010a9c0008", "comment": "Malware payload (LummaStealer)", "timestamp": 1773570821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773570821, "uuid": "69fb69dd-a29a-4f1d-8b11-ab84277fff16", "comment": "Malware payload (LummaStealer)", "value": "2942e6b312b72671d0b5bdd9b1afb88d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773570821, "uuid": "9c3593a0-0ff3-4a53-af9e-1633732921eb", "comment": "Malware payload (LummaStealer)", "value": "2097fc1951938d3ee4c53e77f34e023652be3d3fda1b3cf1749d8fd1881140b0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773570821, "uuid": "6d75b2a4-5228-4c05-bfac-c805ef9c8d25", "comment": "Malware payload (LummaStealer)", "value": "fb559e5aca92d70d1dba14a9d4e6609f1675a68d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773570821, "uuid": "56270836-bb32-46cf-996d-885910594c30", "comment": "Malware payload (LummaStealer)", "value": "6a52bbcbd09f996512bf674b287205683a9f58a4fd6242989dd8271db7108c0c43e6634d54e7dc2b8f045d03665cb39c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773570821, "uuid": "21b6e376-6306-431e-9c7e-6b9647914691", "value": "T1CFA54A00B7E92239F4FF0F75993A44598AF9BE126B42EAAD1C81289D1872F14CD71377", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773570821, "uuid": "513fac91-8225-4109-a9c9-76b18f59b725", "value": "87276645a61980fa58d8085fc4df7bae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773570821, "uuid": "f3fe1cb8-d91c-48e3-8f97-39d2b75bd1ed", "value": "24576:WFi0fd5Rl1RJ1AZk5FpaLIRpnEeVDd/lFxASaXl0wZAMGAvVYJePWdvg:CRl1SoFpaLWnpFxA90TMGAvVYc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773570821, "uuid": "ef692496-0ef3-41a5-830f-49a92b84f928", "value": 2247168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773570821, "uuid": "0ae41925-7bc4-4e2c-8bac-aae560d7676c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773570821, "uuid": "9da20d41-f191-4616-bc87-c4a71484d78d", "value": "2097fc1951938d3ee4c53e77f34e023652be3d3fda1b3cf1749d8fd1881140b0.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8fbc1a2-2018-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1773542571, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773542571, "uuid": "e734304a-d497-4112-959e-019db74b7adb", "comment": "Malware payload (ValleyRAT)", "value": "b88936cd4961274cf75bf1fef809dae7", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Suschil", "colour": "#7405F7", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Suschil!rfn", "colour": "#3CC01D", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773542571, "uuid": "a836a796-c8a6-4656-b805-bdc89f1f95e7", "comment": "Malware payload (ValleyRAT)", "value": "2530025bd1fced9443a32079db97f9023a11968ec353f52adf73a8da0edd9daa", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Suschil", "colour": "#7405F7", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Suschil!rfn", "colour": "#3CC01D", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773542571, "uuid": "08e256b9-6f72-4a85-9e61-41f020abab5c", "comment": "Malware payload (ValleyRAT)", "value": "db0904375f3026ce50e1bb07fe6ed4f1006e6268", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Suschil", "colour": "#7405F7", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Suschil!rfn", "colour": "#3CC01D", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773542571, "uuid": "0c8f825a-c769-48b2-afd7-cb19f48d8ebc", "comment": "Malware payload (ValleyRAT)", "value": "5982df029b0302622c16f820842026652a76eb31120140b5637d16b8de5a64e05990fd2e013ebbcb59326f08efbb4bc9", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Suschil", "colour": "#7405F7", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Suschil!rfn", "colour": "#3CC01D", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773542571, "uuid": "30bc220e-adea-41a3-8d67-cede749446e5", "value": "T139183321B566A9B5FA2FA37FA0A4DF9950317EE03337D5D723783B964AB058120B1D03", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773542571, "uuid": "9305a8b2-979f-4377-9d34-e9a65f5b18bd", "value": "1572864:2yGVjCC73Btwc2bidiL7r4j7fQnywSII/H+TGS1/5Fev43wIWpoKz0x3v5SCE:gpCCbBnbdXjLH5/zYTevh3Lz09sCE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773542571, "uuid": "768a9fdb-b2f2-4615-a01e-4d3c316dc25a", "value": 87337984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773542571, "uuid": "f9866cb5-74d3-4428-ac35-58e31baf84ab", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773542571, "uuid": "6f40dddc-d47f-4df9-a097-35897a0469a2", "value": "ChoneSetup_jgoliud_win.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "566a9ce8-2073-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773581516, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773581516, "uuid": "ee558842-009f-43af-8355-9b54102fda76", "comment": "Malware payload", "value": "89a98879e12987b59d878a91b51375f4", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773581516, "uuid": "0867d706-0238-448f-a37c-f2bce88409af", "comment": "Malware payload", "value": "273b58852207b92bdb90699e4be2a559430f18ab82fb97c1d0d3c21d3d862d70", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773581516, "uuid": "640f8e97-d2c6-4423-81ce-941fd13c31cc", "comment": "Malware payload", "value": "7cc66e79f11278fb14465fa357f783cec041e111", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773581516, "uuid": "42888fe7-4dbc-4ffc-a620-3e5ba6a9750d", "comment": "Malware payload", "value": "5f09a3577417f0f7d6c3a636f63db41d9a6379f67da03c5994b89b5277ee8494900db6100c1c7fcac027f0c331237a63", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773581516, "uuid": "f230bacf-db36-4e15-bdde-45803311908a", "value": "T1F253337035C60776C23EB49F6B0E6429903BB3795E51FACBEDF5668B8324C58BA09503", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773581516, "uuid": "c1a0743b-d272-4f0b-bb25-2ebb88bceba5", "value": "384:FvR2vvMR4qdTDiPMKBAu91HgGzkMdfN3ioLP0+Ux7JwPfX9pn4o8ug3lXAVBaEt0:f2uLuAqFcxkvYEn7Nxtaipqc1Ji", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773581516, "uuid": "49944097-60de-4bd0-a532-a36fde5486d5", "value": 62694, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773581516, "uuid": "ed0bec03-c3a2-43dc-b955-8a2c43bec3ca", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773581516, "uuid": "a2a0f92a-29a8-41a9-b8aa-ec7afd9a0f4b", "value": "ACCI\u00d3N ADMINISTRATIVA EXP. 7561-26 RAD. 4902836175.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87182091-203e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773558835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773558835, "uuid": "5604d6eb-978e-4a7f-9298-a1fe953c57e4", "comment": "Malware payload", "value": "58bff3237a289a244078f7eb50d74fb9", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Goi", "colour": "#A81DA4", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "mparivahan", "colour": "#29C0BD", "exportable": true, "hide_tag": false }, { "name": "RiskWare", "colour": "#8F06FF", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773558835, "uuid": "923ff543-9b9f-4dee-ab3b-541947632417", "comment": "Malware payload", "value": "27b8eeb5d1b46e1afa170b998830fe0958f08a2a9dfe7130df607c86ad42fb33", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Goi", "colour": "#A81DA4", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "mparivahan", "colour": "#29C0BD", "exportable": true, "hide_tag": false }, { "name": "RiskWare", "colour": "#8F06FF", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773558835, "uuid": "7e226dd8-1b4d-4eb9-93a9-fd0aa5f272a7", "comment": "Malware payload", "value": "a167f044dead6edd96343a749a8dd513d828bfb3", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Goi", "colour": "#A81DA4", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "mparivahan", "colour": "#29C0BD", "exportable": true, "hide_tag": false }, { "name": "RiskWare", "colour": "#8F06FF", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773558835, "uuid": "85e530b7-5c73-49dd-b958-1d3cb98df668", "comment": "Malware payload", "value": "03fd369df5d2c7129acbae9b042efc8ba4a61d8d2a69c03ea2ac6f8a6dcb7a45c4ddfbff75b9b23c0831e7827af64bb9", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Goi", "colour": "#A81DA4", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "mparivahan", "colour": "#29C0BD", "exportable": true, "hide_tag": false }, { "name": "RiskWare", "colour": "#8F06FF", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773558835, "uuid": "c76d89e9-1b23-4d36-a252-2a972d79d577", "value": "T18A46F191BBED64D7DC72A1BC6A14D9683A528D349FC09303E5E43B1C9633B484D8CBDA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773558835, "uuid": "b52faf2a-ba2f-4a22-91b9-968c2ee8ac2e", "value": "98304:aE/FEciD0KF7vabcd1R9qmObJlB27sSX9Bd1vTI54V:aE/FEcTYaod1XqTJlB27sSXzd1Oa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773558835, "uuid": "5fa41c1f-ca45-41db-b6c0-4193b5bc2f5f", "value": 5448803, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773558835, "uuid": "f2630131-6ac6-46a6-bf67-dec759315ad0", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773558835, "uuid": "c301d901-ddb5-4688-bfb3-d5227dfa481e", "value": "mParivhaan 2.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4357c06d-208c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773592222, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773592222, "uuid": "c5f4bac1-f510-4ab5-a513-15e854c71488", "comment": "Malware payload", "value": "28d703d0ebbcec36d0b8a7abf6bb34a6", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773592222, "uuid": "e7452365-72bd-474d-8859-1f6fa74eeab1", "comment": "Malware payload", "value": "2826be47208d3ba6e58cff60c5af29d3572ea42c283644e437c1dd30238e4608", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773592222, "uuid": "f2a3f46b-13b0-4840-ad44-17b1a21203f5", "comment": "Malware payload", "value": "f70cc0bb2ac22675860add97a4d0a578705f3d54", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773592222, "uuid": "0e315d4f-2287-4af1-811b-0ecf9a59da8b", "comment": "Malware payload", "value": "b91cc52765c6196954f9d5a1ed08a94bc7d4214f478eda16eb9185d71209987281847a73428262e1aa8f5442129a4fc4", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773592222, "uuid": "9eaf584a-a7f0-4a13-830a-8b667dbebbe2", "value": "T19C151811B6C75736DA9701325929F68BFF3606336009DD6AB48E6EA76F73D40A3BB001", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773592222, "uuid": "bd16093a-c668-4064-8cc0-cfe765a655ab", "value": "266da142ed14a40bb52e09d4f08162bb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773592222, "uuid": "37411b48-1fec-4581-a912-d73447876dcf", "value": "24576:OKSB0HjbjbtQyqTCuMgrm9uIURofFeqT7:WyvdiD2FeqT7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773592222, "uuid": "26e8d62d-d0c7-426a-8913-18c4471bd30f", "value": 911872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773592222, "uuid": "28e8305f-a4aa-477d-9e14-4b06b2a7f396", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773592222, "uuid": "89f161ab-837f-4197-9f41-7fb127f240fb", "value": "SecuriteInfo.com.Win32.MalwareX-gen.42287827", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0345f564-2018-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1773542293, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773542293, "uuid": "e0abe0c4-f88a-4714-b0c7-5a60822ebe9f", "comment": "Malware payload (ACRStealer)", "value": "8128b362c68eb492cf43e6730ddc2154", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773542293, "uuid": "97484f7f-7eaa-4410-abb8-2ea8aff35ad4", "comment": "Malware payload (ACRStealer)", "value": "28f57ab575961ea9af28304c09f1533c2d50e79a3934363cdf71eccb84447b16", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773542293, "uuid": "b7c1cd44-ed20-4e98-accf-4deeeb6a1034", "comment": "Malware payload (ACRStealer)", "value": "218d3517d021b65ff4a8496c62bb7ddd626a5796", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773542293, "uuid": "0d19ab6e-6ba4-45b9-9ed4-77b27dac0583", "comment": "Malware payload (ACRStealer)", "value": "06bbe8cce4c72462cddc91aeead4454f0976c3a00c59353d137f625d51d2947caa04c2d44c6df25e28d7cc8b144acedb", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773542293, "uuid": "9218818e-169d-4406-8b06-dbc07589769e", "value": "T118442328A26B51AA7152112CC4F2BD91FB2D88BFB9CF74F5208981D3CD44673E95723E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773542293, "uuid": "09399340-2621-47ea-9037-42083158ba9c", "value": "6144:JUh+fUsd6UxPEEqbuMosGjnk05R7GOGKo+quj+XY/FVtwSO:JU0MKj+JuMossnk6RqooDG+I/dO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773542293, "uuid": "91e12041-d54f-46dc-89dc-b58d0c7e3a5f", "value": 277505, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773542293, "uuid": "d42141ac-5131-458c-81ca-e156d8b701ff", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773542293, "uuid": "353ab9b9-9176-4f41-9227-260e69c867bf", "value": "verification_google.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a09062d7-206e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773579493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773579493, "uuid": "b1e76255-4bbf-48cc-9a85-f26e45361d38", "comment": "Malware payload", "value": "66303430fd370caaf9ef183a6821a6b3", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773579493, "uuid": "e38339bd-11e2-446b-b88f-872fce2eaf46", "comment": "Malware payload", "value": "2b2beed27f0244e8d977fe224ecac8610c9b7a3c0eec9b95d07a0004db23ef31", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773579493, "uuid": "2c4162b2-7206-40d7-b48a-9bf98e69290a", "comment": "Malware payload", "value": "afcd127f2663b8c362d72a74cd0dd7d301cc4163", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773579493, "uuid": "b57375d3-f08c-4a9f-91de-0025dafa6470", "comment": "Malware payload", "value": "98a8782ce37015f9124e262f568fb65990b3bd3ba716f8e104ed200a4a2b82a035ef4cfbe1f90ef34f5633e1f83049ed", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773579493, "uuid": "a1327d34-b2d7-4404-932b-18057aa57cf8", "value": "T1B3C623AF57F45D7ACC219074CA4956EAF084AC484C794C2A7F823E4DA53C8D6CCAAF35", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773579493, "uuid": "68ddfcee-6d41-4b33-a44f-efb820aa90c2", "value": "3d9d4fa0f734aa85e027438ca479fbf7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773579493, "uuid": "9ac12f8d-6d38-468a-8c4c-c89fed36d406", "value": "196608:J7l5WCI462Ec3my2t2gu/7iulX/sSO6BRdxgtaUts6tfVnmHQJqWDrqONSw:Ub2/mKXr3dYa8PfUHbWDrqk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773579493, "uuid": "689b295d-5159-4c9b-8328-e70360468fb8", "value": 12143360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773579493, "uuid": "58cb6102-34be-43dd-91d7-3fb90678c09f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773579493, "uuid": "9b23e4c8-0580-44f3-9e73-31ad01aae323", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7141895-2050-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773566619, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773566619, "uuid": "d25ddd29-8135-4355-a0f2-2ee212b7c4f0", "comment": "Malware payload", "value": "e58209f017ab91c8aacb1ae41871be03", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773566619, "uuid": "38817d17-6f1d-4e6c-bcaa-8cccf4dad30f", "comment": "Malware payload", "value": "2c98a7452c49ccd942303624fc9bc279711a8bba0d0a65675a3b103d9ab157f8", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773566619, "uuid": "d70617e5-4cf6-4d27-8e55-abcc4b546d92", "comment": "Malware payload", "value": "a76af806154f3fca14942b2331b544e4893b04a3", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773566619, "uuid": "96f6ee1c-912c-4b3d-ba08-e23d0e46feb0", "comment": "Malware payload", "value": "963b0992f0efa92325bda9818f69313f2a5a5a82d2eeacc33e9ce482f479efaf8253f5e174257fb325e93827b4927c9b", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773566619, "uuid": "22171186-9e91-4daf-b777-fb9bf93ed86b", "value": "T182B3FF88498A88789F5F3068B51F3D0E9ADDA117065CE480FEEE5F953F129F131B96E0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773566619, "uuid": "cb7de126-1eae-49f5-ba27-ec6597539f2f", "value": "1536:xJ3rpa5LPr/Bla1olD/PImgdxtPBve1FdvmPh21Lj:Ijr/HRaYOPM1X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773566619, "uuid": "d4c6bb1e-ebca-4d70-b911-e6fa02271430", "value": 116107, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773566619, "uuid": "d11f033f-0cf3-4080-9b65-1abdd4efa341", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773566619, "uuid": "61ba647a-8054-4c7b-9b67-a7b58b0a5256", "value": "External_Report_Updated_1913.jpg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29dcfa49-2049-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1773563403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773563403, "uuid": "f0fd7109-eda0-416a-b71b-52a1a7b42442", "comment": "Malware payload (AsyncRAT)", "value": "3b262ba2ec3fe3574f9985b574a90a72", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773563403, "uuid": "bde066ae-d38b-499f-b7af-cc6cd9f424ed", "comment": "Malware payload (AsyncRAT)", "value": "2dd42412bfac018f483e116e12c5b40a0930cdede6dcc1c6bb406189f5a24107", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773563403, "uuid": "31268602-030a-4df1-be2c-b130b0dfd6c8", "comment": "Malware payload (AsyncRAT)", "value": "aaa5944a84a4e2b518ea3f5d5d1218c23bbe7519", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773563403, "uuid": "f3ed84e6-7244-4d5c-9bdc-97e6b3367361", "comment": "Malware payload (AsyncRAT)", "value": "75d274df6f40aa374484e4ff8c78c96aadeabd554c4c7445db09747d395eaca2da7310620b83ee3dffa9e6b6426bd154", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773563403, "uuid": "a66a36d2-37cd-48df-bec2-57cb7f720ba0", "value": "T12C474A91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773563403, "uuid": "308380fe-d049-4968-8616-8ba7c36fac98", "value": "75d930149d98b9b34c55459c6a79b293", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773563403, "uuid": "77300f63-fb5d-4853-8818-a5cf2bccaf3c", "value": "196608:GUEtQeTbvf2zlO12sJTv6Ja1cpVLyXIldPlbuJHC:GUEtQevvqc2W1cpV2XI32C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773563403, "uuid": "866b0801-133e-4891-8fe5-461ffcdff96b", "value": 24995320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773563403, "uuid": "a664a03b-4383-4139-ad25-31089ec75288", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773563403, "uuid": "da2e0546-0684-42db-904d-9f0c101a17af", "value": "xworm_loader.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9e54e2a-208c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773592421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773592421, "uuid": "004c6d00-2602-47de-9eb7-564982aa459b", "comment": "Malware payload (Mirai)", "value": "5475e84dd92ac95ad2839cdb084c533c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773592421, "uuid": "48e8a2bb-3d2b-4328-b3ce-26ba01b3fe21", "comment": "Malware payload (Mirai)", "value": "2e1b0f95f23486b88ea692c4b532e80dc29bd74bc1a516b15a4500324fb99f55", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773592421, "uuid": "b3287b71-db44-450c-ad3e-5a0a38912b61", "comment": "Malware payload (Mirai)", "value": "9dcabf3bb56d1a6a4d9458dc1ba6f1fdc67da91b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773592421, "uuid": "9204bc9e-f351-480c-8cf2-2d2ed7a8d58f", "comment": "Malware payload (Mirai)", "value": "a54fc5d4bfee3f7a556bb6b6c8a7f0e531fa58b9410f247d1c469290ae10766287dd470aed3c50f2dfff0ea86613168f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773592421, "uuid": "4796782e-629f-4f42-b502-0608371e22f8", "value": "T101045C95F4019F7CF4CB95FE8A270A05A230535531520F1AF2A3BDDAFC261AA5A0FF85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773592421, "uuid": "b96725d9-44f4-45c3-a0bd-47517943f841", "value": "3072:e+KoNwx5mOT5DWxZ2YMgyZnbXLj7AB5awoNP2vxpsqZc0L3vEdWiwNacjp9+dLoF:e8NwXmOT5DWxZ2YMgyZnbXLj7AB5anN8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773592421, "uuid": "350d1808-2fca-45fa-bb6d-1537310281f2", "value": 185632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773592421, "uuid": "8ff168a7-fac7-45f7-87f2-150725cb13e3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773592421, "uuid": "57cfff20-7484-4b5e-9cba-52ee429aea58", "value": "memory_load.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e3ecc7b-20a0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773600749, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773600749, "uuid": "b17c0c71-13df-48bf-96bd-c8f7f9eae80a", "comment": "Malware payload", "value": "ed0f5c2c342bc7e35f62e1783c1affe9", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773600749, "uuid": "433ac268-fa58-4248-84d4-d08b75e37448", "comment": "Malware payload", "value": "2f4c569ee323a12d3e5a1334a49269a0b03fd9d27cb17024a618b53f1027358b", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773600749, "uuid": "7031b51e-2ae6-406c-8f23-69fc68fb8fbe", "comment": "Malware payload", "value": "5c4e02c8182add1d2388a9f159b8bef849e58e2f", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773600749, "uuid": "0bd5c585-0485-4e0f-8ff3-e69531e9baeb", "comment": "Malware payload", "value": "3daa534fd29662976d677695490c53409c633b800f888ac98327680bc443c974f298218f20bba2af704f32c44724925f", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773600749, "uuid": "6aba8272-9e6f-45dc-a41b-4dc35b927bdf", "value": "T1802833C35FA2E810D7B6AE3B2305ACA3523D43577B8594AE0D83329319FC6746F6D252", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773600749, "uuid": "24961f30-cb4d-45a4-8f01-8bd88caa047a", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773600749, "uuid": "1c68d869-5167-4e4d-a08e-c8b7fdffc6ca", "value": "1572864:AYxcPsjznV8dgZL3y3euucFKT4foTuwwwXYPDwmjA8d+5ZW1e/W5JGud2f7:DO2znV8dgZL3DhEKkoAPxkIIaJGuk7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773600749, "uuid": "799d5bc5-050c-4951-b676-bb0daa36bb75", "value": 101059690, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773600749, "uuid": "6836e7a8-5e71-4dee-8d1c-e2b545f18b2f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773600749, "uuid": "7bd68138-ef89-4097-b2b0-e706dbb7a3a3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2f7a011-2037-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773555875, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773555875, "uuid": "efc29ff4-f6a3-44cc-9c13-f2bb76020868", "comment": "Malware payload", "value": "f4d05b4fd34f7ae08631cec04d0f3b95", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "Ministry of Public Security Vietnam", "colour": "#D46C08", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773555875, "uuid": "90f1dbb4-d9fc-4515-baf0-24546a57e166", "comment": "Malware payload", "value": "3522b20d6461dd3bcfcaa85c30e810f515045331116f9ff92c6555773342c3f5", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "Ministry of Public Security Vietnam", "colour": "#D46C08", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773555875, "uuid": "8c93cb72-d9ab-47d8-b74c-ef3de73d318f", "comment": "Malware payload", "value": "7469df29d99668c9983ba9f0ba758f874f011421", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "Ministry of Public Security Vietnam", "colour": "#D46C08", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773555875, "uuid": "64518541-bb15-42f5-9b50-13a720107091", "comment": "Malware payload", "value": "2b74b0532e9a7c33a149ff22e9c6a94626eb07c21985e74f0deec3627f9fe34a77fe7a4933d079586390694a0cd5ab16", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "Ministry of Public Security Vietnam", "colour": "#D46C08", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773555875, "uuid": "091cfd9d-95c3-49a6-bfbf-96aa356a5dee", "value": "T1C4272296F761C7B8C1BF0075496281A723432E4A8D434B4B114CBB9C7A73AE85F99FC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773555875, "uuid": "f8b8e2f0-bb93-4ffd-ac8b-6446a8e7f69b", "value": "393216:mw+zkgJuLPziOYv5FhvLmZRoQkx2+Aa9En70thEgN4Erld9EI:xeXcOHvdSZR9kPv9e70tFT1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773555875, "uuid": "59bf5273-f32e-4196-bd5c-b05afcff2519", "value": 21149869, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773555875, "uuid": "ce04c62e-7edd-4077-84e2-8ab463064e91", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773555875, "uuid": "6a962882-5f94-4750-98ae-19498bd20bbf", "value": "D\u1ecaCHV\u1ee4C\u00d4NG.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe9956ce-2042-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773560753, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773560753, "uuid": "e19b601f-1d25-4e8e-a5d6-9040aa6e7acd", "comment": "Malware payload", "value": "15b4ba5b316051d941f276b661dda30f", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773560753, "uuid": "70fc89f0-f8fc-449f-b007-e05891672ed1", "comment": "Malware payload", "value": "354078865d8ba88d386fb4590bec1ae8e91a2eeef9827c59faa896bd9e044339", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773560753, "uuid": "604b2875-152a-4bdc-9181-6b4c90bd34fe", "comment": "Malware payload", "value": "c5b8ffbfb1381c474e5ce433081c01d9ab1ac9aa", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773560753, "uuid": "f3d7f606-1219-4615-a858-0db1e6f972ba", "comment": "Malware payload", "value": "7d71e9d534b2df9f0469bf1b35c5c707929138043d557d05698a70d5955a51f170381d07da25bcbbb015db98a8e2266e", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773560753, "uuid": "c2cb171b-8014-4943-a7af-6c5d5fe9d448", "value": "T10CC3530E58CB45A90BA76855917B1007EFB8470A0A2FD4D47B2DFE6C7F0A1FC82ED991", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773560753, "uuid": "d7d1aeb9-bdd2-46b4-bcf4-17ae52360c20", "value": "1536:ai/y1qMuqtSqvSrypR/BUZ345CrvodyNo46adHoVnu:F1qHTE9dHD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773560753, "uuid": "5bd093e8-8904-4548-b1df-8b0ebd5e68ce", "value": 121750, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773560753, "uuid": "e8dc7e35-3d32-4f56-b47f-66e1bc3e61fd", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773560753, "uuid": "6cec9fc1-ac25-42e7-ac90-ede85a0d5ec7", "value": "Global_Config_Draft_2598.bak", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d46b3be8-20b4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773609645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773609645, "uuid": "55c4f7ef-a81e-4d06-a80d-2e3e96f86e7a", "comment": "Malware payload (Mirai)", "value": "eec478bcdb181055e218802e1bcc05e8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773609645, "uuid": "0e1bc58e-a9df-4471-83ac-22ea9252b3bf", "comment": "Malware payload (Mirai)", "value": "37e9291e1017e84a102d470870ee8c0a3e3bcc1f7eb896e67e968c58b379a498", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773609645, "uuid": "bbe9ca8a-2315-48da-9890-af8a6a4824c8", "comment": "Malware payload (Mirai)", "value": "e25fc7e983393e5463e7af9bbecd80681bb43455", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773609645, "uuid": "b7c4f5bb-0772-4234-8e72-3dbf281a78a1", "comment": "Malware payload (Mirai)", "value": "8b0d91cff1b706b272573f7b6601d1d10d0bcbea9c0a89542cb2436950d00cbdd30036cff6820a3bd0ed2eaff8955122", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773609645, "uuid": "269ff6a8-626e-4055-a69f-c9bf979cba18", "value": "T11E830995F490CA22C6D4267AFB5D518C33231B78D3DD3206CE249F356BEB95A0E3B942", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773609645, "uuid": "9517b44f-51ad-4c57-a80e-ff8368c1d606", "value": "1536:TdvUjxQGPePVkpq3JrOgo8TX6m0HFcL/vgGmO5Kuh4iIRZu6mdsL7yq77BXcOu9o:Td0ePVOqd+kxLzku2ipjeyi+lr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773609645, "uuid": "7f51626d-784f-498e-aa51-9a7c1b719cc3", "value": 83524, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773609645, "uuid": "2eb97136-95ec-4057-8b08-221183c0e0e3", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773609645, "uuid": "159d4201-235d-4a3a-8365-1fa56cb36b62", "value": "main_arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aad6cf66-201a-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1773543433, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773543433, "uuid": "fa231f67-b8b9-41a5-9fac-01a0f2195f73", "comment": "Malware payload (ValleyRAT)", "value": "4a74a6f7fcdf4bc88aee5814a3465eb9", "object_relation": "md5", "Tag": [ { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773543433, "uuid": "4d12f36a-da09-4ddc-8f85-e4fbb2331709", "comment": "Malware payload (ValleyRAT)", "value": "3856bf5d8508d54624bb9b626e5572240bd15469a37300ded86420f20fa18a8d", "object_relation": "sha256", "Tag": [ { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773543433, "uuid": "a9f0828a-51ba-49e0-8116-b2e7d90e8be2", "comment": "Malware payload (ValleyRAT)", "value": "f75606418291e7f4f163c95de33fdc83c17320c0", "object_relation": "sha1", "Tag": [ { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773543433, "uuid": "bb00e85d-ac65-4b42-95be-1157352b09af", "comment": "Malware payload (ValleyRAT)", "value": "9bb6aacca250fd0e50f267ecce6f7e38372dc9922a88253b5e01fe7f8d85345bc1f58ce29212d3ebbc960064b455c836", "object_relation": "sha3-384", "Tag": [ { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773543433, "uuid": "c10a562b-cd4d-4170-9afe-88700faa840e", "value": "T11EC3C30266298425F30907B06965F6E5059AAD7C0FD6F2CFE2BCBD3A28741D368B315F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773543433, "uuid": "fe517f10-4756-4030-8266-6368a55265f4", "value": "0c73b126e59800ba06613ad42ce55ad5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773543433, "uuid": "d7604da3-c3eb-44a1-bd7a-9b334ccbd016", "value": "1536:BsTXDuSIzsTvhi2x4P8HE1tXuzTVwISDwiHRS1YxTbeYhhThhIaoDxSaG3hG5XOe:BEPjsgvKhhGZo8ROsvdpYSHv3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773543433, "uuid": "dab3c82d-0ec7-43d6-95fa-ba7ede0704bb", "value": 124456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773543433, "uuid": "71db9181-4777-4633-8a12-cd3d6973b351", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773543433, "uuid": "995135f0-949e-4f76-b1b2-b53243b42a5f", "value": "YnA2FjA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f26a0ef-20ca-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773618978, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773618978, "uuid": "ebe326c1-075e-4a6e-b67d-127c5a3c0d04", "comment": "Malware payload (Mirai)", "value": "d2baca74cb41426ccdaa67093955be4f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773618978, "uuid": "086055f9-4c92-44e4-9858-78029d21ed36", "comment": "Malware payload (Mirai)", "value": "3ad5fdc8e4f5e79353fefb680572564a1e1e89a523fb28487a35575b7673f983", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773618978, "uuid": "d8e397fb-2cf9-4336-8833-3b1f0da6a4fd", "comment": "Malware payload (Mirai)", "value": "def819c3212199f9e0fbe486b57b00a14604e4ca", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773618978, "uuid": "62dc4c5a-6f17-449b-8d37-4bc05f3592b5", "comment": "Malware payload (Mirai)", "value": "0afc24ffd8abc0d0d95d07a4b989e8901e946b978f6bf434bdccd42f42ef48612a2889997579e058ff4e49f222a44146", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773618978, "uuid": "3de1320e-001a-4f99-8397-9155bf717639", "value": "T1E71329D2B8C29B37C1E0127AE56E805D3325A7E8D2CFB717CA156B417A8A41F4D77B02", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773618978, "uuid": "b694ab8a-3b08-455b-b0a7-3be843cc1430", "value": "768:fJlaRQ8XJe0q0QZWHsdzstNgMZeijbjz+8yGlMGWowq71dUx:fa/Xs09QWNgeRTByG3w61d6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773618978, "uuid": "3d1e555f-4aeb-48c7-8bf0-f9a4892ae3df", "value": 44576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773618978, "uuid": "bc39d93b-c95b-4540-86b9-d33504c11c98", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773618978, "uuid": "4e344872-6626-4c4b-9267-e95b50d072f4", "value": "parm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c48d3c31-208c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773592439, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773592439, "uuid": "0bdeee69-9bca-4bdb-b24f-a27c2a80f4df", "comment": "Malware payload (Mirai)", "value": "3d876bead8ef366749622b9e711a0fe1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773592439, "uuid": "3cdaab89-387e-49fa-a4c5-9d89779f1d21", "comment": "Malware payload (Mirai)", "value": "3b1a166cace1c6b13fadff877fc58c65c4adb1cd6576b00782e6cbe9d7c44f25", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773592439, "uuid": "f1fa1b47-b774-4694-bafa-154dadc13985", "comment": "Malware payload (Mirai)", "value": "83595b5b766072ed8da53f411213d9908d0dec2e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773592439, "uuid": "87df1049-dd06-47e8-85dc-25c74533ca0f", "comment": "Malware payload (Mirai)", "value": "1f9419ac273f21ace025ab519f1d5dbbe9c54a5a2c68e40015db803376f90dafcf1d5fd5a2f06b69a4cadeeebb5a81c1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773592439, "uuid": "0d706e89-4d3e-42f5-a8b4-7dffdc25efd8", "value": "T1EC443D46E9409E13C5C127B6FAAF414A33329769E3DB72028D286F7437C7A6E1E37605", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773592439, "uuid": "bb48f319-279e-4403-8885-31f1232ef353", "value": "6144:X+Pqwa+yvBuFhi2rLA3YDfra9ooM6veLq26OyrEM/99/sfj:XoqwgoDfra9ooM6v0qZV/ro", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773592439, "uuid": "62b2cca2-635e-40b8-83e3-d7d73f62237b", "value": 271762, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773592439, "uuid": "a4bb514e-89ef-4cea-aacf-e9f157454206", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773592439, "uuid": "53172fb0-bf6b-48b5-ac3b-82d1770eee85", "value": "memory_load.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ab13cd5-2047-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773562599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773562599, "uuid": "06bdabd2-eb19-4c15-bce9-04023a3db9eb", "comment": "Malware payload", "value": "5ca6709547122f51ecea48565e506e76", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773562599, "uuid": "19f18ba9-e788-4a3e-801c-df8f7b25ea46", "comment": "Malware payload", "value": "3b4c85d2e41273f33e8d6aff06ddf4b75a242a85d65ecd6207b321c9fd8722b5", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773562599, "uuid": "8fa3b142-5cbc-4569-b9e9-a80b7b8e8334", "comment": "Malware payload", "value": "98ce0e98121c5c3de81499257be5c240a209bc5f", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773562599, "uuid": "0f88bee1-7a6e-47e6-a577-2b069eecbbaa", "comment": "Malware payload", "value": "f31867dde6cbd82a3ed658cfc1a12794103f8bea3c20f628d901082bea1c8ffad3543a3b6dce6e250feea0b1f5a08708", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773562599, "uuid": "754092b8-480a-4629-8535-7a1fffc48fd5", "value": "T198925CB506496C79BBC0CE799F3C7F0CADE482C42129E39DBA1F39714A2165DC60935D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773562599, "uuid": "b4ce0ffe-5d9a-450d-9f96-6e7b887ed204", "value": "384:BCncuxOLnVYMSFzsO9a4cbddrME8jyfzsO9a4cbddrME8jy4:BJuQL+FzsP4cbddr7zsP4cbddrk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773562599, "uuid": "aca2fbdb-3acf-4bdb-83a9-c646457b39e0", "value": 19491, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773562599, "uuid": "92fa9e44-1b53-4c85-90b2-9404987a973a", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773562599, "uuid": "18edd918-c074-4bbf-b779-db50942e3f1e", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "100706d3-203e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773558635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773558635, "uuid": "68ab2bdc-228c-4e02-beb5-09cc6e2d2532", "comment": "Malware payload", "value": "e2287592557a0e2d8d5f8a22f89effcd", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773558635, "uuid": "be5a5d63-663d-418b-b3fa-2d464552ba4d", "comment": "Malware payload", "value": "3c54a1adb76ce7dd25477d1f18a7a442a737144172b9e29da1225fd8e5107514", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773558635, "uuid": "71f1dc42-a4f8-4709-a2e7-0181f84642af", "comment": "Malware payload", "value": "dfbcfe2a9430043db31e521b9125f04d58cb3ff0", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773558635, "uuid": "644f5ff4-8e72-48a3-ba1c-05837b7f79f4", "comment": "Malware payload", "value": "5ed3ad76bdd0214c1d2a7372076d8d7f30c07cf2be34d3eda2ecb27a64eaec0c8513013434f2b31493e73763fa2dce06", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773558635, "uuid": "ee1755d3-a449-4fa7-be3c-2efffe5caacb", "value": "T10764C804DA12843AF1D653EAC7F90ABD7CF82B51238011C3E3D55CD7D91AAE176368AE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773558635, "uuid": "4b4af9bc-1203-42d4-bfe6-41c379f79424", "value": "3072:mSqW5Sb9RwAT9WaKCwcctZ10v88Y8tWDfX4h93fs85EfL7nKyzQnwzZOOB1v:bqkSbVW790uDf+sWyzS4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773558635, "uuid": "2d543929-ebdd-4245-a677-75fc8a6e07cc", "value": 328192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773558635, "uuid": "fa326e55-4c44-43c1-bfaa-f9ecc01a4c16", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773558635, "uuid": "2bbb0f91-43e1-4f5d-8494-b0d5d960f7c7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad3f9cc2-204f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773566200, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773566200, "uuid": "7996f4cb-afe2-4a13-9444-9a0ec8ac061b", "comment": "Malware payload", "value": "b345f289e4ca2a61dbd894cfaffa45c8", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773566200, "uuid": "7609ed08-f583-447e-92b7-1237c58c5d63", "comment": "Malware payload", "value": "3c5dac409eb2cd9bd6019866c895d31b687cef053df4e767080b15d0487b0a2f", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773566200, "uuid": "dfc32aef-79d0-4949-a22c-8339d705eac5", "comment": "Malware payload", "value": "45e6aac2dc4990599145717785f1be756f738e79", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773566200, "uuid": "f905a4a1-d079-4911-868b-d64b87b8ba99", "comment": "Malware payload", "value": "1fa49e29be3173bc9fd7906870575319d1e3f8e78115fa1416ae4cd2f74378b8d3471d2b282cfa4e66288afa8a8b24f7", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773566200, "uuid": "b69cf99d-53f7-4576-8f41-f149b0579c3d", "value": "T13E925CB512896C79FBD0CE399F3C7F4DADE8C2C42124A3ACBA4F39215A1166DCB05359", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773566200, "uuid": "3b506a0c-9406-4181-b7b2-9be30db14a72", "value": "384:NFcuQpWx+BL0SWL0g5zsO9a4cbddrME8jyfzsO9a4cbddrME8jy4:NF8i+BL0SI0OzsP4cbddr7zsP4cbddrk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773566200, "uuid": "f6901fc0-521f-4777-9dea-5b3aac4ae359", "value": 19499, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773566200, "uuid": "10f9b18b-35f1-466c-93e6-96dde1672534", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773566200, "uuid": "a3a465d8-5cfc-4bdb-851d-0f9fa8312a7b", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e1bf9a1-20ca-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773618869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773618869, "uuid": "f5edb483-794f-42da-a2d1-cccfcfb7627c", "comment": "Malware payload (Mirai)", "value": "f95a30a1a9d5f917e8d20fca7e6fe483", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773618869, "uuid": "9bf9f71f-ccea-4e46-80c4-05efbe7cfdf3", "comment": "Malware payload (Mirai)", "value": "3d2a3e33b0d222b92a262eb38b836d2416dda335d23c18a3c6924a4da16893c7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773618869, "uuid": "5526b686-e3aa-4b96-af88-a336854d0626", "comment": "Malware payload (Mirai)", "value": "c5346e5e5473a1a38d1fa0a4f95f2a231e763a78", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773618869, "uuid": "beb57551-9fa0-44d3-945c-0fbac1b3cf17", "comment": "Malware payload (Mirai)", "value": "3a325bb453bc3ca89ac060c2c11b52cac856dc1daef3b6c779dee67e3d1c9360fe9f58958fa6ea37942f3e0fb44c5ac9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773618869, "uuid": "9b1baed4-707c-4a91-90bd-e7c0aa0bde8a", "value": "T178835C91B9815B13C5D012BBFB6E018E772A13A8D2EF7213CD26AF11378785B0E77652", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773618869, "uuid": "506dc2cf-c9bb-4d5a-9cbe-7babcf6fc08c", "value": "1536:K1gjTcAjL0MRl/YkLumT8tOs/ycdt/F15wvb61d6ow:K1gjXL1LuOBQ+qRw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773618869, "uuid": "98cb65f3-123a-45d6-b4c9-5e7d5be913d6", "value": 81408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773618869, "uuid": "43239f23-71f4-4b3f-b669-e1e504e59d44", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773618869, "uuid": "7ee579c5-579d-4357-949b-ece40b6c315c", "value": "parm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f12c4ab3-20b3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773609264, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773609264, "uuid": "154e5acf-fa8b-4bde-ae62-88209644bf26", "comment": "Malware payload", "value": "a88de419d761a0e394f21d3f448617a6", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773609264, "uuid": "d4d69212-982a-440c-9fb8-950875e8fc83", "comment": "Malware payload", "value": "3d47f24364467b5d790757b925822dc740f87f114d65638c64069a3cfcc51a95", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773609264, "uuid": "342091a6-4edf-40cc-bcd8-2f0e7ffe611a", "comment": "Malware payload", "value": "2436578378709dd8ed64a0b9a2197037f885c802", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773609264, "uuid": "f024288a-7426-44a5-b68a-b4017a50f4e3", "comment": "Malware payload", "value": "e39e6ff66e72d48d9a373da6cc5ca83fc2d2d3f67fbafa737a67f19608dde1823f8a3c91ea46f0e78d4724081546c5dc", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773609264, "uuid": "2e6448fa-4c15-4dfb-99a1-8cddaf0242de", "value": "T102B617ABF2E0CD78C15D913AC0A2BB0184F76179073BC1E74599176BDA22BC49D7E923", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773609264, "uuid": "34725dea-8e48-4022-92d0-05b01c7d0020", "value": "b8399aa8e7b34c992334ad63f681f404", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773609264, "uuid": "40f71510-6b99-471a-927e-01c83ecc9e2c", "value": "49152:h3BDMNyKXcTCa1C7hoaeKEvj995SA50moXGQRdReVTVpzXtdF6UY7N2AHqfQ5O01:mZ9edRST2ASMO01", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773609264, "uuid": "72398206-8f7c-49c7-b894-c894c087cb71", "value": 10636800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773609264, "uuid": "f75c9ad9-00b3-4d54-be5a-bba2f3ec0159", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773609264, "uuid": "4e0e2bf9-007e-4d0a-8abc-8c568b62bc1d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38dd6f4d-2034-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773554408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773554408, "uuid": "1db264c0-2a1a-473a-90a4-95d0aa14c532", "comment": "Malware payload", "value": "e6a4ba8991f73e9b7f8762843e14e20a", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Botim", "colour": "#9E3C56", "exportable": true, "hide_tag": false }, { "name": "RiskWare", "colour": "#8F06FF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773554408, "uuid": "f39e741f-cde1-4ca1-b82e-282504b228fb", "comment": "Malware payload", "value": "4064f42a30b85220545e4a43672e374ba879b36b3d79c4a5e2324a3ca1f6df8a", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Botim", "colour": "#9E3C56", "exportable": true, "hide_tag": false }, { "name": "RiskWare", "colour": "#8F06FF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773554408, "uuid": "9019ba93-c6c4-41d2-9ce8-d295d12448ee", "comment": "Malware payload", "value": "786d331b1a805c106c562290b3211708c935ec64", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Botim", "colour": "#9E3C56", "exportable": true, "hide_tag": false }, { "name": "RiskWare", "colour": "#8F06FF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773554408, "uuid": "aac0937a-aa0f-4bd1-b5f9-81e66aa7f2b8", "comment": "Malware payload", "value": "576d4e683a26d7d281db2da1faa98198698ee5f7cb6483433dadfaf00b19fc54daff207c7c3309798b21d03523f534fa", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Botim", "colour": "#9E3C56", "exportable": true, "hide_tag": false }, { "name": "RiskWare", "colour": "#8F06FF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773554408, "uuid": "ccd3ac19-2f82-47f2-8b23-ad1fbec87ad8", "value": "T103A533911FE09E40D3CE84F0078A7F1273AB446E261909F656C21DEE7D12CFE86EB995", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773554408, "uuid": "364c3a7f-b31a-47ee-87ec-cc4055f63c10", "value": "49152:6PcWtalS4f9ojvTAnoLs2KD2jYilYhclFpOkLL5ePSySVua5Os2:4c98jvTkb2PjYEYiZnwP3WZD2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773554408, "uuid": "5723a40c-3903-438d-a3fa-3c2fa9bbaed1", "value": 2065455, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773554408, "uuid": "2fd7cd84-faa6-40ea-80bf-1bfd1c41c20f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773554408, "uuid": "4172a8a8-a9fd-4327-86cc-1faef5f50c08", "value": "Botim.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7961e12f-208a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773591453, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773591453, "uuid": "3fd6fa61-ab1c-4cec-b821-cf1ef86738c7", "comment": "Malware payload", "value": "a3570890d8507e9967099a81eae4b97f", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773591453, "uuid": "18f9f458-59f9-441e-af87-7b491e37dde4", "comment": "Malware payload", "value": "407dc13883ac98457cadcda39e0541d28a5ae3a4f4dbb5d1284cb8636a6ac108", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773591453, "uuid": "f0b29c24-56ed-4c32-a199-4dd4e8a79743", "comment": "Malware payload", "value": "36380e57a6a6e7fd06f3259cb8c7b87635a29fa4", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773591453, "uuid": "fd43bade-2b1e-4767-a6cf-c76b0b49082a", "comment": "Malware payload", "value": "52e66a4f34c73145723525b010269e7a7f40964f62f96dfb9c43df2788df1b3923ff75459e8c480e3dae8b09617f7a1c", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773591453, "uuid": "21466833-31b6-4ee2-9e84-888d82f20267", "value": "T128855C477CD114B6C469973289B662A2BB30B8084B3233D72F926B7C2F767D05E39B54", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773591453, "uuid": "dd032357-3d79-4a65-bf0e-396d458f394f", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773591453, "uuid": "738b0c51-1ad4-440c-b884-8d31aba696d4", "value": "24576:5Inj6u1rdH3L7JqAvd1ggJ8AsA7dk111OGiWfKbOCXF01c:5Ieu1Vyp1115lwF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773591453, "uuid": "82382b4d-3fd8-463e-b1b2-1a88a9c4ffda", "value": 1797120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773591453, "uuid": "e2f2ea22-5b1b-43aa-bfa9-e3c245fd0d5f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773591453, "uuid": "ac42936a-d977-433b-952a-0d9e69b392a4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81693742-20ca-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773618955, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773618955, "uuid": "b7bb3954-4b96-4402-940c-fbe50ef9bf97", "comment": "Malware payload (Mirai)", "value": "641bbe1c87f53b98d06d82ca9a10a749", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773618955, "uuid": "2c7f62d3-8e98-4848-a671-391fda36c000", "comment": "Malware payload (Mirai)", "value": "408bd8864f88433101a6b47d001d6c6312e0a380dbb60d49f0ca9df8a9d5fe08", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773618955, "uuid": "ca0218c4-7dd9-4bb8-a468-a29f80904298", "comment": "Malware payload (Mirai)", "value": "fbe95b2a6b83f937ce623876969602f1e1105ed9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773618955, "uuid": "87c30c9a-a0c0-4e53-a358-e2ce42fbf524", "comment": "Malware payload (Mirai)", "value": "ff39c275f99769ad74670372b831dca26aa01dd6a794f3047169889e83e664f88f2bba31ff4ac3bd005064f55c7456ed", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773618955, "uuid": "da2038f0-40c3-464f-87ea-ab7cd8caa255", "value": "T13B92D02814D2E032D6E00C37DE6A89457A466979E1F673B23F1B9344F68F58167B8BC3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773618955, "uuid": "006f60f1-2b34-47da-bf0d-cdd182c6a5ec", "value": "384:2uu1uGPCl4YYEJ9yyQ/9ceV14ThC9dDPwYXrKj1YaJgnwibM41/DhymdGUop5h55:aCl4189Y9csmC9JNuYaJMQk/Ds3UozWe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773618955, "uuid": "5dca60fd-70b9-4409-aaa5-5323cc473e0e", "value": 20868, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773618955, "uuid": "984a5482-b140-4996-b79c-ebc6fe668530", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773618955, "uuid": "eb5485b3-faba-492e-8fbf-2744f2e529fe", "value": "parm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "767a5aea-208b-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1773591878, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773591878, "uuid": "e0e3c5c5-6c45-4de0-8729-6ff2ae55c3e4", "comment": "Malware payload (RemcosRAT)", "value": "1bd2f43243c3ae0a802d19b947da5854", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773591878, "uuid": "8044e5fe-63b3-4529-b52d-f59db4709930", "comment": "Malware payload (RemcosRAT)", "value": "40d44ba0b24aba1f6610dddb436dcc054d6f67da9c49f70a32c4bda113008c17", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773591878, "uuid": "d779e210-b106-4595-ad89-c9e773d3e32f", "comment": "Malware payload (RemcosRAT)", "value": "6c6be850334b16a600f032911a3d6dc9c31d2b64", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773591878, "uuid": "892b4515-441a-45d1-9e9a-8d2f71c3829f", "comment": "Malware payload (RemcosRAT)", "value": "7dbd40e122e7dbbe9a1805a4c89ea8e5f1e62bb8fe85b904a97ad59e0c741d7e83fd6db6075c8728b5aa43310b3684ba", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773591878, "uuid": "b6990e1e-13b6-43d9-8ed4-6368c56cbc82", "value": "T11455CF027381C062FFAB91734F56F6215BBC79260127AA2F13981D79BE701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773591878, "uuid": "f8d00310-f044-406c-abc2-145c3ee2bd7a", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773591878, "uuid": "f52dbee7-c5b8-4004-a967-39b96042decf", "value": "24576:O5EmXFtKaL4/oFe5T9yyXYfP1ijXdaWhk5thAkiZaGDYbQL0K:OPVt/LZeJbInQRaWhk5tGZzJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773591878, "uuid": "4b213bbb-390a-43d2-a959-70b18b4b02a2", "value": 1387008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773591878, "uuid": "cca7e1f1-e89b-42b5-8d08-cff9285984ac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773591878, "uuid": "833b5aaa-0a87-4b69-bdbc-b34048001419", "value": "factura-098765.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32d5f2d5-205f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773572867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773572867, "uuid": "8a1d8a2d-19f3-4b46-ba01-65159e27eb14", "comment": "Malware payload (Mirai)", "value": "e4ae520e995744c96832d54d6908ac3e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "ppc", "colour": "#812D4F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773572867, "uuid": "8c6eb944-d7a3-430b-b623-2faa7b605a48", "comment": "Malware payload (Mirai)", "value": "415f061c5e10d19dbf808f21c51d4e8d2fcd7b589c435c93df4d0534dbbb5ce5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "ppc", "colour": "#812D4F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773572867, "uuid": "eb914615-22a3-41e8-a987-f42f9c589884", "comment": "Malware payload (Mirai)", "value": "cbe12efed70988ea31efbbe7e0954f04425a69cd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "ppc", "colour": "#812D4F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773572867, "uuid": "f8075f71-e29e-4fb8-9b6a-ecfdd0cfd147", "comment": "Malware payload (Mirai)", "value": "caa3ec3fdd14a809d81bc0f6739af71825257e6fc569425e38d99ed2f73bc4d8d31956779bd0ec37cab0f0a2998cdc6a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "ppc", "colour": "#812D4F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773572867, "uuid": "73d8f420-9245-4365-a820-0fb17d4c0baa", "value": "T128F35C02BB194A4BF5960EF5243F27D183BFDAA061F0B685794E9B0E4231E722556FCC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773572867, "uuid": "c02735f8-1a2d-4fe3-82ec-15ee4b912003", "value": "3072:vC7sgB+hvxohonCJGDTqOJBav6IiW+P1gUVKc151oLqov56pG:16+3HHqOJMStgUVKc19G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773572867, "uuid": "31cde3d7-b401-4414-92fe-649854eb94d7", "value": 165364, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773572867, "uuid": "48f437db-7813-4353-8cda-5d6fee951c4f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773572867, "uuid": "17413276-45aa-497b-acb8-63a8f7e4f6b2", "value": "memory_load.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2dac221-208c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773592436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773592436, "uuid": "ec4deb6b-3786-47c1-9e8a-2f08279999ee", "comment": "Malware payload (Mirai)", "value": "92ac11a844d9244b8f29878e94751ee6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773592436, "uuid": "804065e2-76be-4d27-b2a5-25402a121c1c", "comment": "Malware payload (Mirai)", "value": "443e0fb4269edd6774e177eea038da095b43427f97b8f58cba701b583e5591f5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773592436, "uuid": "7d878175-482b-4b60-8234-14308bebe6c4", "comment": "Malware payload (Mirai)", "value": "b6c0776f244ee13403be682628a1ddb9975b0251", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773592436, "uuid": "fcab1470-3f5b-46ef-b2e8-a8b3e1d715ed", "comment": "Malware payload (Mirai)", "value": "1410195398cab4d71fbe64fa5c69919821ecfb7715bb19644da9eecd81a3ac1b7260c033b3aa2663d50010cacd20f202", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773592436, "uuid": "0123332f-4380-4291-a083-a852baa3a3b7", "value": "T1DBD32A86ACA1DA29C7C113BBFA6F119D3315A3ECD2DB7102DC2007687ACA54E1E37B45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773592436, "uuid": "01e6c041-f9f9-4555-8246-dd5bf488510f", "value": "3072:na1WlgfzzfffJM3lwE2tgUO3QmN84F3YnsGb42GAfqKv50:a1WlgnfXcStlQ2+r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773592436, "uuid": "dfc570e6-9b81-4704-b0ae-5350ab6603ef", "value": 136640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773592436, "uuid": "da6b5d25-7905-4343-b818-f9b098964806", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773592436, "uuid": "ea9ba767-256a-4c33-a230-332ed8d17b2d", "value": "memory_load.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb3b5f47-2048-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773563244, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773563244, "uuid": "fe70518d-f235-40d0-aa36-73ff93ee250e", "comment": "Malware payload", "value": "ef29b21d4ff5e6bb7817a9aff3572dd8", "object_relation": "md5", "Tag": [ { "name": "Agent_AGen", "colour": "#118452", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773563244, "uuid": "e96afdb3-023a-443d-ac31-4fe8bd42c823", "comment": "Malware payload", "value": "44ebe9b37b600f533b1d15e068829289251b85248752a213327236d2e4081493", "object_relation": "sha256", "Tag": [ { "name": "Agent_AGen", "colour": "#118452", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773563244, "uuid": "b35341a2-729a-4f95-bcaa-a0664f872558", "comment": "Malware payload", "value": "94838e447a25d2da07605391a57f15c54a9a2411", "object_relation": "sha1", "Tag": [ { "name": "Agent_AGen", "colour": "#118452", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773563244, "uuid": "d4e81f9d-5005-4eea-b166-edeba25ea55d", "comment": "Malware payload", "value": "006c2534307fbf508cabdf774852b1c293ae645e3f0742e973ce6640c095cb9b487972262ade5f2bc86363af049db997", "object_relation": "sha3-384", "Tag": [ { "name": "Agent_AGen", "colour": "#118452", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773563244, "uuid": "0d42d5fe-3795-497c-adcf-4ba33be63ddb", "value": "T17F283321B26739A8D61FA3BFE0B85FC884307DE1B317E56B23787BA145B56836071943", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773563244, "uuid": "3d5c785e-e2f6-42e5-8fb5-3132f648473b", "value": "1572864:ll7SgYK7KnE9m9hBmdn5TSaxDZe3iEf3cT8uDESzccn8VeV0tRwTWfm2CpsM2OXI:ll7SNdE9mYHTSaxDY3jUEYb8Vi0MTymh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773563244, "uuid": "ac8b69ca-db15-4e90-a0ea-0d942d0a9bcf", "value": 99915264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773563244, "uuid": "a10e4fbe-2829-4abb-8e27-9cf0957120b7", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773563244, "uuid": "e9f5dbc1-909e-474c-af85-9393fecabe35", "value": "goodgle-chomex16.83.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90439f04-20ca-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773618980, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773618980, "uuid": "d269d63e-7ff4-45df-8ae1-f966c30ae8e8", "comment": "Malware payload (Mirai)", "value": "22aef6813b51489b1161e18c30cb8930", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773618980, "uuid": "465f62fc-c638-4c19-b390-58e7a5d2d0bb", "comment": "Malware payload (Mirai)", "value": "456e84ced88ab5b7e0539a9a5025ee8bfcf618774924a12af8036f73db1deb80", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773618980, "uuid": "886a5c5b-3e58-4faf-a46e-fc40634c36d0", "comment": "Malware payload (Mirai)", "value": "dce9d84c5992876b3ee4c4a6bd0520b2c4ada79f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773618980, "uuid": "3688394a-f32d-4cae-a094-09d776e8467c", "comment": "Malware payload (Mirai)", "value": "c011a556f31fdc853ea09ea66806137cf91904a59ff336fe5ce0f22d769627013de75f24f0d08cdfa50db421b2b9d6b3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773618980, "uuid": "00cc7283-7077-4652-a0d7-cb2db8e4c99a", "value": "T1E3A3D91E6F21DFBDF269823147B78A21979833D627E1D685E19CD2005E6034E681FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773618980, "uuid": "84db088c-d5f4-4514-a732-e12ceb5f2df2", "value": "1536:V4poNIjCa2Vr69mUpZrLNjkWQGjeuvFXz361d64m:rNIjn2Vr6BhLdkWfjz25m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773618980, "uuid": "a25bcfe4-0c6e-4c89-afa8-456a73bbb7fe", "value": 97912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773618980, "uuid": "b9a0f331-f39c-4b5b-a883-7fcbbc817bb3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773618980, "uuid": "eb6d2f24-775e-494c-a705-d8d04dc3f5f0", "value": "pmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8414010c-203c-11f1-a769-42010a9c0008", "comment": "Malware payload (QuasarRAT)", "timestamp": 1773557971, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773557971, "uuid": "b22f914d-2c78-4dd8-9a5f-6b25e12d5c96", "comment": "Malware payload (QuasarRAT)", "value": "85f69b3229229a1b30a38ce2db04775a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773557971, "uuid": "3adcbace-45bd-4022-8a9b-88f3a18ddce4", "comment": "Malware payload (QuasarRAT)", "value": "45d920001496e846e5f28c755ef5d67f6a0b0f18a5690e6d6fb47a71f65b787e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773557971, "uuid": "72e25210-ee91-444b-a3d6-3256552a7b5f", "comment": "Malware payload (QuasarRAT)", "value": "7990442f16a91751331f1b70c279be4b850643aa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773557971, "uuid": "d2f90e74-d516-4e1a-90a5-eb7fdd3d30eb", "comment": "Malware payload (QuasarRAT)", "value": "43785d4e40aa5ef60323e866dec7df9410c68c9a4d34627c0fbf56052bffc887637ff8188dbbef6f801f0ee9451e9caa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773557971, "uuid": "ec584151-928a-43b8-9944-ba3e66a6c767", "value": "T1F805122BB1B171E6D173427BC1514906D7B6B872576293EF03AC438A2F272A0DE39B71", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773557971, "uuid": "dd302076-8928-4ffc-baa3-e65559a4234e", "value": "469e59bd592f93ae01ff61cd0d813e4e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773557971, "uuid": "d04064da-159f-47ff-8e47-a7ae85d2dcf6", "value": "12288:Ir8VpxdYrMBO4TfQ0bbA9K/OZ7P5fcOu5QTJA10UygsWHO8fdfmux:28VZOOfJA9KYcOu5QTG1gOhDx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773557971, "uuid": "cf141927-b4b0-4666-b3ec-291da6b36e50", "value": 795116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773557971, "uuid": "d3be759a-22b2-46b2-a18d-6100fbfcc898", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773557971, "uuid": "cb2f0134-9e2f-44f1-8804-553805365d25", "value": "v4343.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3f0ed11-2077-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773583364, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773583364, "uuid": "5fd5f0cb-9437-44e3-bdf6-e66726f91a44", "comment": "Malware payload", "value": "738213f7e80c34c5dfa06c5b597af6e9", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773583364, "uuid": "7939fa45-24fa-4059-9ff4-97e22a4a043a", "comment": "Malware payload", "value": "46dc1020933455323246a5f00ca71006925dff1bddc273519884b4fb3f78ca05", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773583364, "uuid": "be0be9f1-b438-4f20-8aca-260b284d8e09", "comment": "Malware payload", "value": "d06d1684d88b1a1b565ee1ff9a90beeda24279f7", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773583364, "uuid": "fb489e23-dd29-41a5-99a4-bdb45274e1a9", "comment": "Malware payload", "value": "af6c1c8209d599f3a091783d959a06564405041e76ebc640d098b59e48e285ede0b3479dc0749376ae2d9332e8d54304", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773583364, "uuid": "91219121-6937-41b7-a53c-065c73ccaccf", "value": "T14C823A0FB9824226D0E100749A62467BD9B9A47237C854EFF7D04AEE0A7C6D2F83315F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773583364, "uuid": "bf29b50b-18a9-4400-97b9-3310a2046aa3", "value": "b8b034a37970476c0e8791d5941c31e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773583364, "uuid": "58788732-9073-4cab-af51-25698d0b0689", "value": "384:KKI0V77PwnhS0tftdynZ+lFZav8U9cwX:Bn0tf3yZ4FZa0Uv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773583364, "uuid": "cdac7776-325d-4dbb-ad51-a10bb97d01c2", "value": 18944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773583364, "uuid": "bf99cea8-32fc-4a9c-ae25-8359865d49d3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773583364, "uuid": "7629d23e-f756-4f18-877d-454ff2bb7e91", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00a2aa53-209c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773598982, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773598982, "uuid": "52aa5e2b-fcee-4b89-b3c9-262c89aad827", "comment": "Malware payload", "value": "b81d8031450264845cdf79851b6a4807", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773598982, "uuid": "9c4dc526-2e49-462f-9c30-98836a345ede", "comment": "Malware payload", "value": "48109c33cf45749a7fdc2629a4c11d9afc59e5378a4a368e08b20f9dbfca7963", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773598982, "uuid": "91bb7e61-3498-48fb-9566-a0153faa6666", "comment": "Malware payload", "value": "5dfa031ccd4cb45f5338eeaad6416a54b15bf0f8", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773598982, "uuid": "364b7bf4-0050-4f41-a239-3e7299b0de3f", "comment": "Malware payload", "value": "3438134b5745b70e9f415952e8da3ae0d8c735e1b23f4aa3aa046a06c9b57f90574e54cf5dcef54e9af68ab4cc0e699b", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773598982, "uuid": "d074fc18-9b25-4ab2-aad1-42ff762b113c", "value": "T1E08109C12F36FB6682CA78B2F03D4C019139C5B84259E044EF2C9A4731CB651B9E5F32", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773598982, "uuid": "82e99472-b046-4033-a797-5717e0428792", "value": "96:/Pd/jKcftTD2J3cHG6dvzN0Y1pIcsu0jBUSye:/PIiX2J3cRZuEIjBL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773598982, "uuid": "c57510e6-a2ef-49f3-805d-42d2282b6f84", "value": 3867, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773598982, "uuid": "dae8c634-46ab-4513-96d3-241bc70eaa68", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773598982, "uuid": "8ffeaacc-d134-4754-bc24-5258f65c8adc", "value": "stage1_decrypted_wave1_48109c33cf45.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d23290c-2037-11f1-a769-42010a9c0008", "comment": "Malware payload (Stealc)", "timestamp": 1773555785, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773555785, "uuid": "9eac8c4f-b141-4d44-9bba-707f35fa5705", "comment": "Malware payload (Stealc)", "value": "438d9171a6282478fcc2cd67daefbc34", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773555785, "uuid": "461f1c30-5b86-44a5-9eb3-f5dde370ad9b", "comment": "Malware payload (Stealc)", "value": "4828b8aae87a5f0c994b920050caf0093da3e296959f6350ccb3c61fba2bdebe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773555785, "uuid": "f36e992d-032c-42e0-a86e-f6283cb3dfac", "comment": "Malware payload (Stealc)", "value": "64652d1f8cf9e6a93cf4502466073dbe4057141d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773555785, "uuid": "2924767d-5e8d-4f4a-b59f-a3ad5ab175ed", "comment": "Malware payload (Stealc)", "value": "0ebc64d07b3b62bcad77f7b194623aa2c03781eee3d75d5eaf470a66f3724be9e22f0e94e15cc04ab740906bd0ae1a35", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773555785, "uuid": "30b31f3a-e413-409a-a483-17af50c83eec", "value": "T122B5630ABBFAC965E4BF1B743DA9C38925F3FD668D01C76B7189034E0CB56004D61A7A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773555785, "uuid": "5ce8775a-7546-4a6c-b3ea-a85d2ae8087d", "value": "77bb604ddb8d2a9df61815c9b5a4d907", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773555785, "uuid": "57551e5f-4cc5-47f6-8c0e-41ca0b90b778", "value": "12288:0BRXpWPhK8WZVo84QTUIU9O5NZUkwz2dzdICFjV+68Jvso84QTUIU9O5NZUkwz2e:0Bb/rVlTUl9O5A7LXvslTUl9O5A7LXv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773555785, "uuid": "e247d8b7-5185-4417-959a-971d9bf51673", "value": 2323968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773555785, "uuid": "8c7f95ff-41bc-49e4-b50b-9c90aed9f72a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773555785, "uuid": "4af9cd20-9a8f-4782-b028-64fcca4b5885", "value": "4828b8aae87a5f0c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2d526e4-2017-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773542158, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773542158, "uuid": "d813ad0f-133b-42d5-ae78-51885c0ff447", "comment": "Malware payload", "value": "feb44fdb7585975150a389c09160d8c8", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773542158, "uuid": "1066de01-cb87-4827-841f-59dc1de5696f", "comment": "Malware payload", "value": "48e817c9ce0c90a807ccaca12eb7ed7275461f2f23abdd0f7cca8e55193b48c2", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773542158, "uuid": "6e3d021e-0305-4aa6-a26b-60ef550b2dc9", "comment": "Malware payload", "value": "2325d8e31638d9c33c83bba3ad3af4fecd384476", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773542158, "uuid": "1608ac08-e46f-4cec-89a0-f2658cdbc391", "comment": "Malware payload", "value": "0f5f6680e707ac31aa146e2307bd73d783f662ac2d03c3d709a148f0ebf66d4721840df9c31f2b32fe96808eec4fb1ae", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773542158, "uuid": "42bad74c-8504-4d9d-b00c-b6c6a1d85f4d", "value": "T132B3305D498F88E5475B382445DF4D1BDB28970B1B0CD6D0BBAEEE603F119B6A0FA6C0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773542158, "uuid": "e02e96e4-ee0f-4198-8546-d03f419f96bd", "value": "1536:NEFg81vjSrZySp/4BXZnUZv1bDjqnZB3W2bU7:bp/4BJnjb4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773542158, "uuid": "3b2d730f-7543-479c-b4d5-1a19a3e00e24", "value": 112167, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773542158, "uuid": "63290e5a-9ec2-4eab-87d3-bc954663e0ab", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773542158, "uuid": "cdcb3d40-d28e-4f50-910a-cb9fcf51d6ac", "value": "Global_Project_Secondary_4057.pptx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ade434b1-2035-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1773555034, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773555034, "uuid": "535d77fa-417b-4ad9-bfbf-13f1b3afe15d", "comment": "Malware payload (Vidar)", "value": "3742c8434576283fee61ebd7bbf57b50", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773555034, "uuid": "3f1d9149-1dea-4e9d-82ed-baeea9d7289b", "comment": "Malware payload (Vidar)", "value": "4b802623bf625441d71e6f357bbbee2481d9250e89576358f5f02dddf04b6bf1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773555034, "uuid": "adf85d68-7d4b-47a4-b636-bdfa7a4272ae", "comment": "Malware payload (Vidar)", "value": "126dc51cf28deb874c96db91c0d2535233f9b811", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773555034, "uuid": "0d295c0e-ea20-47c2-a97a-caa850555adf", "comment": "Malware payload (Vidar)", "value": "1c748e713735ea6ca7ae0e6461f2ff8fbaca2ace11a00c6204f326eaaff71ae2c94e80f46a78b6281798a4f38116e82c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773555034, "uuid": "27670acf-1978-4731-b38b-8a6bbd5efaa6", "value": "T117A59E1BBCD504B6C069933289B692A2BB31F8190B3223E72F91A7793F36BD05D35754", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773555034, "uuid": "0eba916e-7a61-4e69-b761-207947e2888c", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773555034, "uuid": "56237917-c1e9-4a4d-9268-2a7582cebc9d", "value": "24576:bHtmeiWKGGpfEqqbmeh5GBV7gOH1o8Y1E9S6E8AZOGiWfKTUACDi:bNPiWyF1BYOVoKho5OL4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773555034, "uuid": "6a197598-7054-4d86-951b-a778f9204716", "value": 2224128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773555034, "uuid": "8dcd3ef4-f361-4ae8-96c6-88e0bd4a2c3d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773555034, "uuid": "4d710cab-2084-4a2b-b30f-c7cbfd80f750", "value": "Bootstapper.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1c977a4-2047-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773562772, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773562772, "uuid": "2f344e31-5483-43f8-803c-f5b6ba063855", "comment": "Malware payload", "value": "57b317db73c66b45fa8e7a4081ed4e3e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Staser", "colour": "#31DED8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773562772, "uuid": "40ed6b39-9ae2-45c1-8dc1-51566cb17512", "comment": "Malware payload", "value": "4c3cd771f427cb7bb6319313710af43e464e4227e007296961e3fd6877ed4027", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Staser", "colour": "#31DED8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773562772, "uuid": "e285b2e1-0c5c-43c4-81e8-15007d5cb0a1", "comment": "Malware payload", "value": "71d1ea770a67f51d3c2d0469c6ceec1872a7d3bd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Staser", "colour": "#31DED8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773562772, "uuid": "4ed17dca-d878-4860-baff-2fd8b8dfe66b", "comment": "Malware payload", "value": "a7c6e3cc45754c58c69785807ce520d706996a624b7bf8358f5ed317dd9cd8d85d0f59aae17d195f753879f4e5b9b30c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Staser", "colour": "#31DED8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773562772, "uuid": "3ce3a0f4-d71a-4293-8365-4787aa04fca9", "value": "T1B5662262B6D144F6D612973088A26B39EB71BB020F35CBD74361CF696D33290EE37256", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773562772, "uuid": "87c18e40-31f8-44db-b1af-e4eb2fd11eb4", "value": "e271e4b700152611d36860962c6413a0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773562772, "uuid": "949690e8-23a3-42e1-a143-44d82e307dd1", "value": "98304:WpI+92WFc21AsqYJPNuNuVjW3zVYzMF2+0KJg0CnvwZLBOo06HDNzc4j8ji3CXCr:WpRFdTqBtz2zq2+0KqkOF6jtdsMsCO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773562772, "uuid": "1e8db839-9160-414e-8a3a-39c8870dd997", "value": 6751839, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773562772, "uuid": "28a2f970-807c-4a62-ae52-ff8c2be94ec0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773562772, "uuid": "7915198c-9c78-42df-ac57-8f873bca4866", "value": "program.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51333625-2020-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773545859, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773545859, "uuid": "88058a65-e447-42aa-8f3b-a2d20cba51e4", "comment": "Malware payload (Mirai)", "value": "5f6627202cc526c75b2026e5e39043e7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773545859, "uuid": "b0bb0815-95e6-4a2f-9882-4bcb27abeacc", "comment": "Malware payload (Mirai)", "value": "4c9c451ee9fce127dae278eeac763dae233d09d227711c556f7a8941d5c37eb5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773545859, "uuid": "53758664-4a1e-4924-917f-8f4f6a127b8f", "comment": "Malware payload (Mirai)", "value": "01485dd51fdf6f7851af828e76aeab86c318500b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773545859, "uuid": "eb5e5a4f-6db8-4f2a-8b15-2d19d80849b1", "comment": "Malware payload (Mirai)", "value": "59faa08999321dda7d1fe938a1961b719205a67a9540047b3fab0a4d3da28be20f9800f1821eff7c4572d2cb76349b34", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773545859, "uuid": "dd4ad571-e13b-44f2-b554-1993a2c3220a", "value": "T1DDB30A52BD529F13C5C321F7FB9E46483B136B78D7EA3102E924BFA127864EA0E27511", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773545859, "uuid": "65aebb94-4767-480a-8986-02255c4bdf16", "value": "3072:JNNP8OTmpVhcDh2xkAsEpZ5zVQSurAW2:KGmpVyDQxkqpZ5zCWW2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773545859, "uuid": "ad176313-d918-419b-9b3a-1b2851bdcc3a", "value": 113428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773545859, "uuid": "d47cb6cd-173f-42a8-a625-9a33bf31afed", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773545859, "uuid": "b3285da3-43fc-4ce8-b68b-f11d98f8dd24", "value": "data.arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e34025b-201d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773544512, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773544512, "uuid": "31a7f0a2-926a-4a39-9625-55011132b8a2", "comment": "Malware payload", "value": "7367d0e845d84727026a9c4170377917", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773544512, "uuid": "f6eafb5c-0474-462b-b36c-6e88a1b8f3f2", "comment": "Malware payload", "value": "4dd9d9953ffac418546a28e23d52ccc8c92d863f0495c8980070457088f94297", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773544512, "uuid": "e008b680-4748-432d-b048-c35dc8dc3279", "comment": "Malware payload", "value": "6ec7b4af6a7e16c086949e374c71bab636deff0e", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773544512, "uuid": "de78439a-0be5-4dd2-ae49-0e97aee1ed41", "comment": "Malware payload", "value": "7c9e51fb620baf2a1abecfa9afae135da171543e855a068a6d84d18e1b087c72e352f97ce521b55f9d12b8496a643d0c", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773544512, "uuid": "44cca0b7-be22-4d68-bdb1-283871648076", "value": "T111925CB512896C79FBD0CE399F3C6F4CADE8C2C42124A3ACBA4F39215A1166DC70534A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773544512, "uuid": "03a7a671-93de-40fb-bb16-03d23b57db1c", "value": "384:6FcuQpWx+BL0SWL0gBzsO9a4cbddrME8jyfzsO9a4cbddrME8jy4:6F8i+BL0SI0azsP4cbddr7zsP4cbddrk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773544512, "uuid": "9a1ca7fd-0639-4893-b026-8f32b692a5cb", "value": 19499, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773544512, "uuid": "47b75c60-24a0-4d69-8856-2fd8fe20fbba", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773544512, "uuid": "699cc0bb-fc10-4222-bc13-46cd501d510a", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73e0782b-2017-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773542052, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773542052, "uuid": "0d50e9d1-c3cd-4944-b840-cb932618a9d4", "comment": "Malware payload", "value": "61e26bf2ad8eb5bf8e222852603824fb", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773542052, "uuid": "3e9bb54a-360b-4105-9bb4-425bab1cc287", "comment": "Malware payload", "value": "4e3ae67cf9bbce30e3ada000d1b03b58d503bc9b55c360a1fb34445915f364ab", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773542052, "uuid": "69f0d12c-ac03-4ac3-9395-1d899524809e", "comment": "Malware payload", "value": "367aea07e37d0058584a232bda5ba013f8c45396", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773542052, "uuid": "4994ce2e-0545-4c70-a0d7-9aacca9735ef", "comment": "Malware payload", "value": "5cb965f8fa1d151d4e63b42561e607331aaa5e9532f36a1da6fc41943c2286d2e7db856da2863bd08bdbaae06612cfa6", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773542052, "uuid": "707eabec-99f1-4b67-a947-baa649278d6e", "value": "T159925BB916496C79BBC0CE7D9F3C7F0CADE881C02118A3ACBA4F39715A2469DDA0535D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773542052, "uuid": "0062ea7e-132a-4ceb-bea1-c738517ae14b", "value": "384:nx0M3vgRjGlsaq7szsO9a4cbddrME8jyfzsO9a4cbddrME8jy4:nBmjf4zsP4cbddr7zsP4cbddrk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773542052, "uuid": "e6b3fec7-87b9-4410-84cd-98426d4ba319", "value": 19499, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773542052, "uuid": "256a2cca-2d16-4358-b5e5-aa1c92d7d4ec", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773542052, "uuid": "2bcece1e-2c3e-46c3-bb6b-f21cab8364b6", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcea27d1-2048-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1773563327, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773563327, "uuid": "c54019e7-604c-4625-9abc-2ed226bda099", "comment": "Malware payload (AsyncRAT)", "value": "e579f4f040e7d99ef57611b1df2bdee7", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773563327, "uuid": "2c608319-11c0-4f98-baa8-8a5c0708cbab", "comment": "Malware payload (AsyncRAT)", "value": "52c7cb1b79652bb317c68fb4173010bbbf937ed09af679802622c5ccfb5e63eb", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773563327, "uuid": "9fd01b36-bc9a-4846-a389-0cd254ba0ded", "comment": "Malware payload (AsyncRAT)", "value": "ae43203448c7f040d3d1d76c96947bd5e710530f", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773563327, "uuid": "e2ebbf34-53f8-4145-b8ae-877290bd0e3c", "comment": "Malware payload (AsyncRAT)", "value": "8462e23076f41b912924e1580ddfeca65ea90fae12d526690d07cabb77c16ea7632af2479f926ce8f1aa595dc312720f", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773563327, "uuid": "38909fdc-f533-4056-a60e-14fc33a03e51", "value": "T1B8878B0773E600D5E9B7D1388AA65507D773B8638331CADF329D06152FABAD09A7E720", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773563327, "uuid": "ceec2a9c-348d-4c61-ad8c-27b3b481546b", "value": "4d0fb8dc9ee470058274f448bebbb85f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773563327, "uuid": "d6091257-621c-4909-bb70-a8b65fa69b01", "value": "393216:f1Du8BtuBw2FEL3Z3aLUoQvo6LP/SgbSpYvKEh1EdKwlGQKPJuGsiTfREsrgCYfR:fMguj8Q4VfvSqFTrYR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773563327, "uuid": "5b55517a-7139-44c4-bb05-62b705fdcb4c", "value": 37693352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773563327, "uuid": "4d105e74-5442-4f5d-9e84-335521aa31a5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773563327, "uuid": "21401bc0-43ce-43e0-bf40-8ab63203b064", "value": "node.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aead3840-204b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773564485, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773564485, "uuid": "6fa80e28-cbce-44d9-9c0b-6352b97a9cb1", "comment": "Malware payload", "value": "df5cd9af89e69098798bab61a089a0b3", "object_relation": "md5", "Tag": [ { "name": "Disabler", "colour": "#776734", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773564485, "uuid": "d764fbee-f60c-460c-82f1-4a64f078e4de", "comment": "Malware payload", "value": "5350acd36a18a31fbaa447d433dfa0f8d29923d67a4f92c86b5579dd9cac1214", "object_relation": "sha256", "Tag": [ { "name": "Disabler", "colour": "#776734", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773564485, "uuid": "a4da7112-d177-4000-acf6-17c8842d744f", "comment": "Malware payload", "value": "63833596537f7e411454b7516d8d4d61742eafce", "object_relation": "sha1", "Tag": [ { "name": "Disabler", "colour": "#776734", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773564485, "uuid": "581f552a-064a-42eb-946a-2ee558f357e0", "comment": "Malware payload", "value": "77a10cd16780e8ffdcc7b82f709f100545f767a2b925158d317e699473d438f0d073cd8675f14a07a17c4b4d50f16e1e", "object_relation": "sha3-384", "Tag": [ { "name": "Disabler", "colour": "#776734", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773564485, "uuid": "9f240337-a09c-4a66-b8ef-47ac52d61566", "value": "T175C63342EBE8C4F8E17640749C56AA63E37ABC990B7192CF17A877431F274416D3AB13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773564485, "uuid": "f9eb3fc1-1abb-4d07-8a6b-fe8942f2133b", "value": "7e0a0e8f80bbd1a9c0078e57256f1c3d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773564485, "uuid": "0a9c4a10-0635-47b8-8b64-835d5e941447", "value": "196608:T0RHBBC9bsTC9EldR9/R55FTRomQJdSnmedBFUdWVUAbhAnBp:CCNsuUfD9EJcmcBeMUyhAz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773564485, "uuid": "f397d603-6085-42da-8870-daf1169a03da", "value": 11820933, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773564485, "uuid": "20f79c29-f66a-41f7-b862-fff5bac80e74", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773564485, "uuid": "0076cd22-4027-4b5c-8c9c-4b9661ce256a", "value": "MiniShit.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "686d02a6-20b9-11f1-a769-42010a9c0008", "comment": "Malware payload (GuLoader)", "timestamp": 1773611611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773611611, "uuid": "312bbb23-df1e-4d77-bc70-6af492964b8d", "comment": "Malware payload (GuLoader)", "value": "3bb29fee2c100fa29ab186b3517ab4a1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773611611, "uuid": "840634ef-57ad-4eef-a6c3-1acb76f23896", "comment": "Malware payload (GuLoader)", "value": "556c002aee304a4492f240ecb287c19aaf6fb3fc3983b8caf92e1dce9fb3e0b2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773611611, "uuid": "56f82172-f033-46e1-b9f6-a997b488cd8f", "comment": "Malware payload (GuLoader)", "value": "67e0a978594e959e69cfcd78a2e263b7bec90ae7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773611611, "uuid": "2cf463b9-3af5-47d9-a697-f882314e32d7", "comment": "Malware payload (GuLoader)", "value": "0cc0cb4415c67a601bb31bd0be8962dc3a4d3276a11e6fda4f56659ff3315c852913553db1503aa880bbf826725e3e2a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773611611, "uuid": "09397bd1-ea89-43f7-9030-ea35a804a3b2", "value": "T1A27522C47AD0894AE0B10E350157EB745B1CBC172D23FA06F2E23F9B746E6D6E978249", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773611611, "uuid": "302037d4-40e1-467b-ab99-770613847849", "value": "1f23f452093b5c1ff091a2f9fb4fa3e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773611611, "uuid": "c6150b68-0465-4f3b-8bfa-9d9d02a20911", "value": "24576:+OGnCq27h+IwwI8IjJ06w/NuTtDtUKeJGPE8nRKtljZvX9+qe34y2e3uUX5:5OI+I3autEIKeCzRKtl1uuu5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773611611, "uuid": "e42b1b98-5a57-4a1e-8fc8-9f13e9ac69ec", "value": 1609435, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773611611, "uuid": "0fe3c9fb-2b4e-434b-a5d9-634383f5ac4a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773611611, "uuid": "04a0ba8a-7858-4742-b856-4754060a4e36", "value": "TT Copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3464fc1c-205f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773572869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773572869, "uuid": "5ef4527b-1b61-47b3-990c-6762a0cdd0f2", "comment": "Malware payload (Mirai)", "value": "f992ee400cb40f191eb08977c0476d64", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh4", "colour": "#7BD36F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773572869, "uuid": "10dc9351-e8c6-4c18-8eea-72dd40a29d0a", "comment": "Malware payload (Mirai)", "value": "5627c8f9d689b5e7cd763e966b2457eabfaa501938d6e2df3cd0c149d13c36e8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh4", "colour": "#7BD36F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773572869, "uuid": "290e3128-8106-4e81-845b-468369a61491", "comment": "Malware payload (Mirai)", "value": "c023529d262589451b4288bc2c4fa0d85ec2a571", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh4", "colour": "#7BD36F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773572869, "uuid": "8716ad21-5b1f-4a74-9515-69c737e16849", "comment": "Malware payload (Mirai)", "value": "d85559fa578c5365136e1c454de49342b964bb3b9dc5e1a06532ec37ea1486a92ffcc8cadd00cd818f7ccb5c8060c6e5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh4", "colour": "#7BD36F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773572869, "uuid": "6a43073b-985a-4a97-9335-389a23cf38fb", "value": "T1E7E3AE31C0B86ED4C1850BB470B4DE7C8775A92861772EBAD681CA15D487FE8B10EBF9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773572869, "uuid": "f1b6f97b-d066-41a5-8d3a-8be6a37ea4f7", "value": "3072:dAuX43iwDdco7jy2StzYXRgM5v+sOFkawq0v503:uuX4/yqXOM5G/kc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773572869, "uuid": "859679b2-ed16-444a-bff2-ba6bbdef4d26", "value": 157132, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773572869, "uuid": "601dc938-196c-4f4c-be5e-16b4455e5ab4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773572869, "uuid": "11e0e449-62a9-4b68-baba-c23b08730ebb", "value": "memory_load.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04045a34-2003-11f1-a769-42010a9c0008", "comment": "Malware payload (NetSupport)", "timestamp": 1773533274, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773533274, "uuid": "940c2f18-1d5e-4852-ab25-642025510720", "comment": "Malware payload (NetSupport)", "value": "0e660f7e5a6621a9185a7b8080364500", "object_relation": "md5", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773533274, "uuid": "e3ccb4f7-91b8-4d8e-b1f1-d767cd666f47", "comment": "Malware payload (NetSupport)", "value": "56ebaf8922749b9a9a7fa2575f691c53a6170662a8f747faeed11291d475c422", "object_relation": "sha256", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773533274, "uuid": "f379535f-e5f6-4491-a8d3-0fe6afbecc6c", "comment": "Malware payload (NetSupport)", "value": "3b7b47b6260ab67c120a13a9c207efa91ebb7ace", "object_relation": "sha1", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773533274, "uuid": "ab5d23e9-108f-405f-8d5f-afa8969c40cb", "comment": "Malware payload (NetSupport)", "value": "7be80c666ed940c5d54dbf520fa35076c5a56e141c44ff1c4654996e27ead75b31bd319b4c9fccbf79cbfd20b5acd3bd", "object_relation": "sha3-384", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773533274, "uuid": "78337a3e-070c-43a8-8831-c991f43cb17d", "value": "T1E4C3B40F4699E173EA42E97DC8809B050C64BEC9B5F458FB005EF63E3E3178E2B6415A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773533274, "uuid": "647d7aa4-1b28-4b2e-a112-191525941194", "value": "a9d50692e95b79723f3e76fcf70d023e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773533274, "uuid": "b44ae8e2-e6a2-4370-ba8e-7c7d2cc9b2aa", "value": "768:NEVZl6FhWr80/0KEvr2bhuRLKzCKZikEr2bhugkKzCKZikW:NG0hG8KEj2hu1vN2hubvN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773533274, "uuid": "381f1197-0f71-404d-9986-71b76d5f9630", "value": 120256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773533274, "uuid": "14aa42f1-2d86-49ca-90f6-51daaafa8c52", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773533274, "uuid": "518ff38a-c7f6-40f3-a07c-89c0bd211620", "value": "Service.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42710ce6-20ca-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773618849, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773618849, "uuid": "ca06bb97-051e-464a-b40f-8bf35a8b594d", "comment": "Malware payload (Mirai)", "value": "1bf2ec953bd052ee9a18c971f1176ddc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773618849, "uuid": "2f35de6d-ff1c-436e-a1fb-6c561751e345", "comment": "Malware payload (Mirai)", "value": "58c4461d1fc2d51c23a52c23c3d3d1bfec31689a97a9f92302ce6775684e13e7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773618849, "uuid": "af2e894e-59fc-42f0-8218-cb2630b1b218", "comment": "Malware payload (Mirai)", "value": "cfe6b4e2d759bac39def63377ed948d408380dd4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773618849, "uuid": "a94630ff-7a3f-40f1-8946-59cda67329a3", "comment": "Malware payload (Mirai)", "value": "9d529210267716f53f40eed79da4bc97715d2707f9a3a094363da10f0682e8055c65306233d484370f0cb65cb2b63cd9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773618849, "uuid": "9910ec99-7aa9-4f22-a97f-ad4285102a2c", "value": "T196837C32BA751D27C4D0687A61F30721F2F6479B25EC8A1A7DB20D8EBF2564032477B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773618849, "uuid": "7856eec4-cb09-45da-98bb-d3816b4682f6", "value": "1536:BqjSIdmh69OHkGvTdN5zoX5azQKt0qrNM5owQovwVY4t/7o9VNNus73:sWTlEG3VMaScN8vQKkK+s73", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773618849, "uuid": "d7ac9ad9-7b0e-4179-9d65-041d3eb2f1e3", "value": 85512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773618849, "uuid": "61ab3964-b97e-44d1-a2c4-f2ecd5d98dd9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773618849, "uuid": "3cbbed62-5cb1-4d87-b6f7-a3c3facf3efd", "value": "pspc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fea7449-2033-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773554152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773554152, "uuid": "b38955bb-7ad6-4b21-9ef0-0e277ef6b0a0", "comment": "Malware payload", "value": "2fcf521ef8e52107f10060781f62400a", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Click SuperApp", "colour": "#670C60", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "RiskWare", "colour": "#8F06FF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773554152, "uuid": "d33cf191-fbfa-47ce-a774-9c4ee2f625f0", "comment": "Malware payload", "value": "5c15f4808ad986ff87797ff8d01120a5016d6182f08788db73072bec43d53814", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Click SuperApp", "colour": "#670C60", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "RiskWare", "colour": "#8F06FF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773554152, "uuid": "39deb296-f7bf-46a5-a8c1-ac2c0e84cc96", "comment": "Malware payload", "value": "2185a3ccd5169fd342944455c8bb076c5660a824", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Click SuperApp", "colour": "#670C60", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "RiskWare", "colour": "#8F06FF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773554152, "uuid": "44776026-6a68-4822-a86d-4bbcc6733663", "comment": "Malware payload", "value": "3b01b08d06cf8ebab026f728ccffb81617eb0e4945f38a2191a4c9dd924755ad45e980bf641085715fd55b591ccc9584", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Click SuperApp", "colour": "#670C60", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "RiskWare", "colour": "#8F06FF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773554152, "uuid": "0e2183d1-f840-4af4-8984-7c154055a36b", "value": "T147D5E011BE419E03E47E433AA4F6A2446233AF80CF97D77B2178767CA8776C18D52786", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773554152, "uuid": "80cfa005-38df-49dc-8de4-ab85a2f154af", "value": "49152:p8pLJ2FtWxHbtnwesQCuma2gje+xHp88IokNjiR7lFfHApZ30zN:gJ2Ft6HFtotgje+z5ka/AniN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773554152, "uuid": "2b4c5bed-8541-4169-8267-8cbc4b5c4625", "value": 2828665, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773554152, "uuid": "5776d605-a9f1-47e0-a8a5-1c49a77e83df", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773554152, "uuid": "6e31458f-7aec-48b0-87c6-ce6059d14183", "value": "Click SuperApp.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8211180b-20af-11f1-a769-42010a9c0008", "comment": "Malware payload (Stealc)", "timestamp": 1773607359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773607359, "uuid": "305f88dd-bcf0-477a-958b-a90ac5ff5c00", "comment": "Malware payload (Stealc)", "value": "88fbcc5efeff4f5a6570c4259481a169", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773607359, "uuid": "79949e53-a470-4d4a-8927-fd3eb9104468", "comment": "Malware payload (Stealc)", "value": "5caf5d53f72b909bff50e5f959db0252a623c1d0737b306f34e1ffafdd86f10b", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773607359, "uuid": "b5c4b447-1015-4fc6-9b4e-fdf68542a637", "comment": "Malware payload (Stealc)", "value": "522a7a40970802444236812ebcf1dee343a7c24f", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773607359, "uuid": "2b7eaf3b-62ee-4299-9aa9-490b9a390c84", "comment": "Malware payload (Stealc)", "value": "da1beb02829229d992b8d740cfbf8331c8dcb1da9a52059a7e515b19d2496c30eb2b2b7a916ae7e97770f1633d64f303", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773607359, "uuid": "9a8f891c-14ee-48f4-ab9e-15096fc286df", "value": "T10E956C00FDC758F6E806173654AB63AF6334A80A1F319B87EB407ABDF9766E50876305", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773607359, "uuid": "fc975b13-b6db-494d-9f50-502a2891d788", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773607359, "uuid": "28956ba4-63c3-4050-a1db-c49730455dff", "value": "24576:SNPnnerK+2QvLqU5NQtwhQHw5IqrKalFPAWkQznNDUcts2EjNCOYa4xUd/HRb0Kb:Sxwc2OahQaQlhR6sxbS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773607359, "uuid": "7fdd2765-ce25-49ef-bde0-55d42f4dbc6c", "value": 2022912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773607359, "uuid": "66ff22b1-d26a-4087-8920-718518b0635c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773607359, "uuid": "97d9d6bc-c9e8-4e14-aa20-6611b397f048", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7925352a-2023-11f1-a769-42010a9c0008", "comment": "Malware payload (Amadey)", "timestamp": 1773547215, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773547215, "uuid": "b2386721-52a2-4a89-bbad-236a6d9cfbc7", "comment": "Malware payload (Amadey)", "value": "2d6143fc1112eaca6533e945c9e24585", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773547215, "uuid": "3bc7dc04-0c2e-4c84-93a8-268156ad7030", "comment": "Malware payload (Amadey)", "value": "5d2d7935d6fac745234eea85e2a83ba31d71509727bf01ec6f418980dfae6167", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773547215, "uuid": "eda9578c-ad57-4b6a-9e0f-21de8b4cea4b", "comment": "Malware payload (Amadey)", "value": "15d10baf370431290a04a67c6a17c1b55e160b5d", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773547215, "uuid": "b9eb2c90-5b5d-4ae6-a3ff-86dca2024a8d", "comment": "Malware payload (Amadey)", "value": "e3f50118f13ee30ace98388f0e046809d0e59508e773e927ce753616558115e7a4a4e10497ca646feef305f114fc0da4", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773547215, "uuid": "34d4e10e-9988-460a-9101-684e7e0a7d32", "value": "T13E45D760D2D9C910CAB7AD316FE49D54ED2821E35A354A08F0ED3A27DF7394389733A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773547215, "uuid": "766d0c50-1936-4c54-a110-7649adeef586", "value": "150451e02d49e46634c10e914db67920", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773547215, "uuid": "0e71b222-eb78-4edb-9f70-addbab62e6f3", "value": "12288:WhHPpJr9E2mFbAZFo5OweM9Bf/urzZq66F0FKL66F0FK:KHPpJi2mWZF3M9Bf/upXFKWFK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773547215, "uuid": "f1127f7c-c09f-4a8a-a4d1-ca48008df938", "value": 1204736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773547215, "uuid": "3c4326da-c967-4494-bbd5-5aa29cf5b519", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773547215, "uuid": "859d09b2-21a0-4b45-a3df-b8ded2422c79", "value": "x5d2d7935d6fac745234eea85e2a83ba31d71509727bf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ca3ae5a-2036-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773555435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773555435, "uuid": "ec86637b-f98b-4287-af7f-ac5b323b582d", "comment": "Malware payload", "value": "0c29e650d99e0aa6e3ec2f1b025eb9e6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Jalapeno", "colour": "#A14FF5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773555435, "uuid": "47cc1dd7-6c5c-49f9-a107-cb5302026f04", "comment": "Malware payload", "value": "5d4db2e3cac1da48ae87df7ab46f6a9b527922b4785da87851314d16a77d9e08", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Jalapeno", "colour": "#A14FF5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773555435, "uuid": "e567c970-2ccc-446a-84fc-05573efeee34", "comment": "Malware payload", "value": "0a38389f82abc696a1e6b0fd86994104db36e383", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Jalapeno", "colour": "#A14FF5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773555435, "uuid": "5440d921-3c38-41b0-b81d-98e0b5932d6b", "comment": "Malware payload", "value": "5bd478165b9cf6914d93c4b601e48e6f93d38c8e0bcff0f32aee7a3bf975f808b6fcea1730671b4515ad69c4d4ef9133", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Jalapeno", "colour": "#A14FF5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773555435, "uuid": "49f7cb33-ee5f-412b-bc41-c10e147c98d1", "value": "T17AE52813B3154F69F0C686B7B5A8EF3406F0E709B56BA633BCB46E653542220DC4B978", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773555435, "uuid": "21c897b8-f364-4ad7-acca-f8cf603c6a3c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773555435, "uuid": "7618696c-c201-4fb1-8ea6-0a685c637cfc", "value": "24576:KlTVsQ6BKfC+CWDU2fy6Uuri8MmOmbCYUz7PH8Zeaj0HM3ow5XtgvcbvsULsh:ETVeBB2kMOnYUvPbBkn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773555435, "uuid": "0876853b-5444-4215-8dcc-1bf27821347a", "value": 3270144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773555435, "uuid": "8406a885-af61-48b9-abbd-61433be79751", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773555435, "uuid": "32c7e293-5b1a-44e1-99e1-acf11c6abf5e", "value": "HMC.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ebea905-2015-11f1-a769-42010a9c0008", "comment": "Malware payload (DDoSAgent)", "timestamp": 1773541238, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773541238, "uuid": "7bb005fd-dad9-4247-a543-9b63fa2516ed", "comment": "Malware payload (DDoSAgent)", "value": "5851657f6e49a2ebaae2fce076136593", "object_relation": "md5", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773541238, "uuid": "61bdc44f-499b-4277-b854-fbfd76e39da3", "comment": "Malware payload (DDoSAgent)", "value": "5d84a43059e40879ce7dfa16f3c0d0607904aa1ab7434f0dfb5228289f55ddff", "object_relation": "sha256", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773541238, "uuid": "932d78b7-695e-4305-bb57-ee5050d77ce1", "comment": "Malware payload (DDoSAgent)", "value": "1298764fb02064551013c35acaf44ab91edc0954", "object_relation": "sha1", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773541238, "uuid": "ab2610c7-bbce-4e5d-bc1a-187d97939c64", "comment": "Malware payload (DDoSAgent)", "value": "731ea977947957a183c339db4bdef80aa6afa5b4631d87c76e64ee1cee2d9389901d39a21ac3af44e0b2df2384cdd1ed", "object_relation": "sha3-384", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773541238, "uuid": "db09f464-f8cb-42fa-a42b-a35befe75ae5", "value": "T1D1157C9DE786E4E1F66300F1025ED7F70534A12A5013FAF6EF8A266274327616F1632E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773541238, "uuid": "04778593-f85b-4e7d-9be0-24893d4cf9e8", "value": "12288:u81gf13K95UM/mNhJAhVFgTPXBlOZ+YwMvdgczR+MyRHwLdEC+Pyt/dFENPVtmLu:Dud6PUMONhJAhgPxldYw+qs3yaECJz2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773541238, "uuid": "d230653b-b5b1-4458-925e-f78331bcb26f", "value": 931480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773541238, "uuid": "795039c7-6249-407c-986b-d7df61f1dcb6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773541238, "uuid": "4a3ae668-58f7-4483-af2f-f7632f659d46", "value": "data.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4e45da9-2046-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773562455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773562455, "uuid": "9539f868-89de-4890-b59d-fa3cc21ba546", "comment": "Malware payload", "value": "233cee33a0acd16d4eb601c592d029ce", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773562455, "uuid": "180b6eaf-ad4a-4aac-ae90-09f9bce28926", "comment": "Malware payload", "value": "5e7e80cb34d6ab8dc5e02e7c4c553851a358d5c30855eed803325e3083b4a218", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773562455, "uuid": "b0dfc340-ce10-4f57-b065-d07fe17c5958", "comment": "Malware payload", "value": "7690da56d68c639222cb0f6b13056169e8698399", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773562455, "uuid": "697ef352-e590-418f-897e-2af3e19a9f7a", "comment": "Malware payload", "value": "bad0d49d7ee1f0cdd08378a78b97b521c003a67e64cff12b71899dd17f04e1e2376e3b713029614490d3ac0dd67673e3", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773562455, "uuid": "25a1a8bc-945f-4deb-a142-f083c21e74ff", "value": "T19BB30FCA8E8EC8FEA79F6069815F5C4BDE4F0202052DC5617AFE7E553F22CA471A59C0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773562455, "uuid": "1b7c2992-88dd-4fec-b995-067a1744708f", "value": "768:/2/eiqzO6W9gA9HVOe+xktSA0JU1G0zH5fRIrGLSZdC0ZUCsVS6w46hs/wz40K+4:/ULQkwxhs/Wkih5aMPjSj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773562455, "uuid": "003b3966-8b62-4175-abc2-ea77485e145b", "value": 116386, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773562455, "uuid": "873a1208-b062-44b4-8be1-d26c75a08884", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773562455, "uuid": "8848421d-b87d-48db-b6cb-ea837b41b2bb", "value": "Quantum_Release_Holiday_8165.png", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0b1e512-2071-11f1-a769-42010a9c0008", "comment": "Malware payload (LummaStealer)", "timestamp": 1773580916, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773580916, "uuid": "ec47acbe-3ce1-4d3d-9f6e-102cfd232aa9", "comment": "Malware payload (LummaStealer)", "value": "7b8e06ac0a6a86411142bd9074d79ce5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773580916, "uuid": "8e4ecc37-e6bd-4ead-a3e7-76bc2af1619c", "comment": "Malware payload (LummaStealer)", "value": "5f73556db8cc7167958fea5e12e3ad91e8c3c9ed3ac16a0bfb17a3a2541f76ed", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773580916, "uuid": "7f032147-f4eb-43a9-a80d-1ab227c26223", "comment": "Malware payload (LummaStealer)", "value": "e5c6ba212a06e7db8eda8bc84a9ad86d6162a265", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773580916, "uuid": "a4963f9e-7544-4492-a507-3298e769bce3", "comment": "Malware payload (LummaStealer)", "value": "6cf6bf6689deb96dd3394ceb03273b0c287b49a062929f5c1f4117e4559a038065c2edfc6088285f419d8fbaaa51bc9a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773580916, "uuid": "9b0384b9-bf46-4056-824a-6d1852af372c", "value": "T10A747D0AEA7351F0CA864979A1DFB33F9E28671113388EC7DE90DFC069635F25536606", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773580916, "uuid": "c85e1177-8e78-43b4-9bd1-666aafa6718b", "value": "99267fa2c5d8938e649c5d615d8a755f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773580916, "uuid": "bf54e411-3875-48df-b7bf-255c8403ec39", "value": "6144:s02Vvjguenyb+pnXFj6D9ea0+ByKtYD1gfjYyiMVyqYp1AjfMV:sTgnyb+dxctYnMmWj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773580916, "uuid": "32b8933a-50ca-4c9b-b5ec-b5b4042153db", "value": 337920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773580916, "uuid": "fda4b4fe-0b11-4e9d-8f6f-a22d52cb7bad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773580916, "uuid": "1ac13af6-2290-4180-b03b-36c490b73ffb", "value": "5f73556db8cc7167958fea5e12e3ad91e8c3c9ed3ac16a0bfb17a3a2541f76ed.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2d56795-20b7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773610850, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773610850, "uuid": "1be5b914-ab87-464e-88ab-c108efd52e06", "comment": "Malware payload", "value": "3899d84b1ef543f54d77c389c4347a47", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773610850, "uuid": "7676da21-e9d9-4fb0-8c47-4e93f0da5dfc", "comment": "Malware payload", "value": "5fe39984c5798c896e45a52f17939859b0ed995a182d53bc418a3a20fcbb5c89", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773610850, "uuid": "39b93e9f-63d5-48e0-b1ef-5f4c32cc8df3", "comment": "Malware payload", "value": "ceed39db348a3c2413b6735899ad8d960d5fd4e1", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773610850, "uuid": "704e977f-e47a-4c09-9d62-247fc11348ca", "comment": "Malware payload", "value": "6ba01a1b0c31655861eae3c8b2d58a6507b2366808c6be63e4ef6f07d1bfa3c9005d491745f91214037ec604e78bbe4e", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773610850, "uuid": "6bb6770c-d132-440d-ad9c-47b2723009b4", "value": "T156925BA916496C79BBC0DE7D9F3C7F0CADE881C02218A39CBA4F39714A2469DDA0535D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773610850, "uuid": "b785d73d-7de0-4c9b-a732-a415fd34cbc2", "value": "384:zR0M3vgRjGlsaq72zsO9a4cbddrME8jyfzsO9a4cbddrME8jy4:zhmjfSzsP4cbddr7zsP4cbddrk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773610850, "uuid": "4ece30de-846c-4fe7-9635-195d3c02dbde", "value": 19499, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773610850, "uuid": "11ea8e02-0289-41cb-8539-8ebbe54c5cfa", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773610850, "uuid": "6e74b7f2-b14c-4b3b-861c-a9f4b6b2c22c", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ae91aec-208d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773592744, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773592744, "uuid": "b586276d-e835-4d9d-a3e8-2476520eb870", "comment": "Malware payload", "value": "7e85133df742c4eaf86a8d10723dd531", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773592744, "uuid": "52fb7ddf-eb43-4c53-9487-3600e22f25f5", "comment": "Malware payload", "value": "60171e71774630b9f5c824e2a4ee4742aff1461e0c1910395430ba1592c469cd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773592744, "uuid": "697dda70-2664-4bae-b32c-75438c7ae4b0", "comment": "Malware payload", "value": "d9b577400fe72c107e00ad8918d5958641d5fe92", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773592744, "uuid": "41ae59af-de40-43c2-b395-9b29f719ebed", "comment": "Malware payload", "value": "6e3bfd7589737cae29f43dae760b763cd34e21dca1ca762b2e8d7bf484f712862f14a305243fab5d2893d95f626d998d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773592744, "uuid": "d2ac87cc-355d-45d0-9d62-628365aaadf4", "value": "T142F7333BE287A43EF09E2A352A77A25095373A55A8564C4396FCF49DCB244700E3F74B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773592744, "uuid": "f6dc4d00-d383-4690-8e9b-49578e87dc1e", "value": "88016fcdef7f227c62171d0afad9aae4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773592744, "uuid": "cf05c88c-d89a-4ef1-af8e-3fc85b1c330e", "value": "1572864:BO+hBnrxwvK3ICXOQaiNMqoBttu4ri6GzG3hEkpX30ha2qkG:BRnrxwvKYCeQzNlotpri6g63ou", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773592744, "uuid": "63f9349c-4c8b-4035-94c6-6ac52981c229", "value": 75190104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773592744, "uuid": "6c7aa93c-00a0-4328-85db-690391500b9a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773592744, "uuid": "5aa94d76-b8aa-4367-b47d-25694b5a93a6", "value": "Ditty_m14_1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48a6ee80-2032-11f1-a769-42010a9c0008", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1773553576, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773553576, "uuid": "6b5d5dc6-be15-4958-b279-5b4b1b2cd6cc", "comment": "Malware payload (VIPKeylogger)", "value": "0f5b8d5338c36cc083bde40055e00871", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773553576, "uuid": "e70bde0d-83f0-4313-886c-772b1c639faf", "comment": "Malware payload (VIPKeylogger)", "value": "61061bd61fd9b9abc52c6041993114456744e4bde92f22423daea647b7f02c5b", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773553576, "uuid": "506f11b0-8719-41b2-b849-d002a24b7ee0", "comment": "Malware payload (VIPKeylogger)", "value": "8fc0246cfae7342bcc0abc1bfc1284368a071818", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773553576, "uuid": "c80e1f5d-f4a1-4920-bb7b-a75a3b009fbe", "comment": "Malware payload (VIPKeylogger)", "value": "5b51a32cb8aa0a95f5fd5e16aa0b8a708fe700b3c06e8cfbb206bba8a1e49e2b0e2346f4f7a3a2562a215942625926c5", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773553576, "uuid": "b86de070-4df5-4f52-9ef3-eec2371b34ba", "value": "T14C34F2014EC8AF78DFF84B1880FE261D53F0864F65A6158EEB37BC879FEA54492164C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773553576, "uuid": "2b7baa51-0457-4a40-a293-6e8d4a11d4c9", "value": "6144:mqjhquNzXDIqF0eFwWFRZWIP0WPDRcYD2I5:mqFFLDF6e6WHwIPDrRHJ5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773553576, "uuid": "e6ab1a1f-3eca-45d1-a721-a28553238afa", "value": 246715, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773553576, "uuid": "42f27c56-b2d1-4c47-a7d6-ffb461dfb38e", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773553576, "uuid": "601abb4f-fbbc-4536-a572-f27492ce6dab", "value": "RFQ-Document_AWB_618-51777014.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43ca3585-20ca-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773618851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773618851, "uuid": "dd333751-8bcb-456d-bdd9-84752ee03bea", "comment": "Malware payload (Mirai)", "value": "ee4dfcf357ed501f4ec7b69d85cf58bb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773618851, "uuid": "6a0d13b0-65b1-4a1d-85d6-395b7dca2c2a", "comment": "Malware payload (Mirai)", "value": "6474cb16360104c810ca64ef611a40f0f7e5c96e2538899e6d658b5c628965a1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773618851, "uuid": "89ca9dd2-22b4-42a5-ad36-e1e1289222a9", "comment": "Malware payload (Mirai)", "value": "ecdfdd42e57349693cfb2b0d149a613ab2d2006c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773618851, "uuid": "ff978970-284b-4e79-af19-17b7db862ab3", "comment": "Malware payload (Mirai)", "value": "a5ad7e3c40dcfa6af9a3f596212ca90b732962bc2fdb07ee6468c5caa4fcb7048f27f7c04e10d9193dae935c282163e6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773618851, "uuid": "d16c5738-a742-44e5-80db-ee9a8a6c3352", "value": "T1E103E1E3D21938D1E7B90DF7E0284A817E9A237C44F5B01F6DE0A2659681081FF7D25B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773618851, "uuid": "802192d1-9537-4a4c-89ab-a70afd34b0b8", "value": "768:P04CCQup1ywZ8wblspREAAxK2J0/1n0RBDPsWbGH9q3UELoC:P0TupMIJM+PKAY07rmWLd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773618851, "uuid": "39c5f307-3923-4cf0-9f92-435fc26d44fd", "value": 40040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773618851, "uuid": "a7d45140-5dc8-411b-98a5-b23e6c7925ca", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773618851, "uuid": "59ff7dd1-eae3-4142-ae21-baba4a4e67c2", "value": "parm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86fbbf2c-2087-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773590188, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773590188, "uuid": "80fa9595-dbe3-40ed-aeb3-2135200c88f6", "comment": "Malware payload", "value": "0f3ff71e82c2c54fda4db55bbd8432e2", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773590188, "uuid": "1bd3b4f4-3f56-4ead-abfd-dbb5e63ce063", "comment": "Malware payload", "value": "648eba26cda1c58febf680a3d7fb5f15611ea3eeb2f3d9fee6d77a991d4ef84a", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773590188, "uuid": "cac40864-d897-4930-9bed-8f5d4a5e8c2d", "comment": "Malware payload", "value": "5463ad4e8cf3d5614620a383d510cb62f3d6aebb", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773590188, "uuid": "53a8a545-7c6e-493b-981c-5493bdcddb9d", "comment": "Malware payload", "value": "38c4696186011f6898aa35fa29e1629d18f6e920c09be8633c38d699a997d3bc76bb9ef5275fbcf0f6d78c8563d081f1", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773590188, "uuid": "9b9359bc-683b-46ca-9cbf-92ed5d9f5e9a", "value": "T140B64AC7F8A555E9C0A9E33586629163BAB23C484B3123D32B50FF682F76BD06E75710", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773590188, "uuid": "7b81ac6a-a9ea-499f-affd-0d49a4ef36ef", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773590188, "uuid": "47f07df6-727b-4844-ae17-60fac19b554a", "value": "98304:/DRbQIUUi3aBBRhPnWcvwxXsa1YkrJJHPyZNE:/9bQIYaB4Iob1B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773590188, "uuid": "d7f1a509-9372-4f96-ac55-aef5d2f03e7d", "value": 11348480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773590188, "uuid": "ba1fd90b-edf2-4b8a-ab93-71ba469ef119", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773590188, "uuid": "22385cb8-659c-4aa5-8769-4f75572631b1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57af9bb9-2029-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773549736, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773549736, "uuid": "4417b617-dc41-4545-8d69-8055a73cf896", "comment": "Malware payload", "value": "cb73d52f2253e10f83d7cbf836e6d944", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GameHack", "colour": "#4EB4E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773549736, "uuid": "85f86af4-a187-44b6-8192-17823dbc6888", "comment": "Malware payload", "value": "64f8772403580b8b04540f070b3f964fee58b106c1da08138815cde82c8da8c6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GameHack", "colour": "#4EB4E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773549736, "uuid": "266e3220-bb42-4706-ba5a-e470f34ef853", "comment": "Malware payload", "value": "e854f0374d2dc85147ded1e619c910f249deb5b8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GameHack", "colour": "#4EB4E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773549736, "uuid": "47a9cabb-153e-4b26-a709-df8f1dfcea14", "comment": "Malware payload", "value": "0949c7e3d074b648a515fd376c1b60fe13e483c320289a63246c0484ce36b6c29367ef47458af8ad0f9d58ea9a0f8400", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GameHack", "colour": "#4EB4E3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773549736, "uuid": "5eb766e6-7273-4146-87fd-ac7117375da5", "value": "T13975BF45B3B800E8D06FD178C957A617EB7234580720A7DB13E48AA82F63BF16A7F751", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773549736, "uuid": "3e53680c-692c-4bbb-b30e-6af5504d3c7f", "value": "0d2ffa355ab3b5cb76fccb5d6ad5aaf7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773549736, "uuid": "8fd8a540-452c-4e74-ab03-1a6c3f9b278a", "value": "24576:5YT3dgYwc7RbxiTYvZJhmyy21OBPBnM25Ep+8VQ2MBB4h0lhSMXlDl/i3nTsQjO7:twXiTYdmHRBJnHuDQd5q3nO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773549736, "uuid": "0349413b-373b-418a-8c35-240e622ec557", "value": 1645056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773549736, "uuid": "b2138355-ecdf-4c62-bb16-bc953c8cc646", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773549736, "uuid": "8a58a8ec-5ad5-4327-aeb6-ef2bd86f3ac9", "value": "cs2-external-esp.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3e2bce9-201a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773543475, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773543475, "uuid": "483b58d4-3bf4-4d33-9c09-33bfd9f867ee", "comment": "Malware payload (Mirai)", "value": "3364d3c4f28e41c58a5eb4441c6443ae", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773543475, "uuid": "87ee07ac-9cf5-4b6a-b998-722b442e2034", "comment": "Malware payload (Mirai)", "value": "65d7c59c8a21d2ed3a427fccfab4ba18227a6fd5d737257870a39dc69f12e03d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773543475, "uuid": "6bc5dbfa-9dd5-4f43-a652-84f73726f212", "comment": "Malware payload (Mirai)", "value": "dacf3c49c2bb5f10c5ea2926402ff7b8db7165c9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773543475, "uuid": "98bf9e82-6f65-453a-b6bb-b54f4e276415", "comment": "Malware payload (Mirai)", "value": "26526f25e750b7548e8d4f59346a69b96fa82f7413c034b473df1eb4d42026da35bc4e74b80f9eb90ab2715d6877647a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773543475, "uuid": "8619e232-6d4d-46ea-9f47-f5386d05da72", "value": "T105C31A16B992DB12D1C311B9FB9E524933136FB8E3ED72129C206FA067874EB0E77512", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773543475, "uuid": "dc98d07a-447b-4676-a85f-452e5af36fcd", "value": "3072:kIKExKFiC87oL5LDkdIa0oK9bnt2+drN6SO:QExKcHY5nkaaAdt266SO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773543475, "uuid": "943ffd87-727f-4aff-bbdd-120e62a2f24e", "value": 121708, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773543475, "uuid": "27030a4c-af9c-4c2f-aed1-7bb698e1c805", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773543475, "uuid": "f20d7ef1-9dee-44ba-9236-1e014f58980d", "value": "data.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76b4c503-20be-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1773613783, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773613783, "uuid": "d3fcb351-8d6d-4864-a4f6-dbb98609282f", "comment": "Malware payload (Gafgyt)", "value": "06571402edb2a6b003a6dc7b732b3083", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773613783, "uuid": "06e3954b-fbc9-4877-a988-2daac4805e08", "comment": "Malware payload (Gafgyt)", "value": "675645d67ee6eadfc44657fd4c10e660496b13375b69e086cd4d9d5038239fa7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773613783, "uuid": "98deedcf-54bf-44c7-8f2d-19abe7351d51", "comment": "Malware payload (Gafgyt)", "value": "ab5dad2add4ead0f615038dca6914f0355b9cf79", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773613783, "uuid": "c5edf958-b037-41d5-b3c5-cce47de50e2c", "comment": "Malware payload (Gafgyt)", "value": "129c6c4819531fe2556e31d5b27fae67b15fd8bea8a9df3f7888bafc93ac60929c9114f99f1c355043d22d29ae4c9d08", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773613783, "uuid": "299b7526-9a13-42d0-a9a7-c902436cdb52", "value": "T1D8E3D609BF610FB7ECABDD3702E90B1225CCB91715A93F797535E818B50A18B4AD3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773613783, "uuid": "86690d06-cea9-4b16-bb41-016d34a55d59", "value": "1536:ZoaimSHu76Sv0g9Dubg5HlCV4o0xyV2WcLCCDE0MDg84w8kZWRCG/0xDkIkg72Fm:yE6Sv0SNlCfSEdD332ChcIYQJR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773613783, "uuid": "9cf26b55-128c-4baf-9da6-8ff9800d6ebd", "value": 153640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773613783, "uuid": "6015ff18-7126-4b8f-b9a7-eb070b252f73", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773613783, "uuid": "8d869c45-7f42-4f9e-abef-81a8b46c30c3", "value": "data.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b9e6509-205f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773572855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773572855, "uuid": "3cf11896-5d6b-472b-9b15-ed93364ff145", "comment": "Malware payload (Mirai)", "value": "b05e6c15d2be8b6d6714caf3e4147e75", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "i486", "colour": "#328A83", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773572855, "uuid": "c913310a-9479-4400-86c7-2d89bd82b330", "comment": "Malware payload (Mirai)", "value": "67fa431f7af1a927f7b570209f0c11b15414293ff83bcd6e61e1d45369f1d2c1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "i486", "colour": "#328A83", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773572855, "uuid": "e4a68352-c3ca-49f1-85f7-f96475ee0d92", "comment": "Malware payload (Mirai)", "value": "01581fbe4c72556d3b33be6e8b99a92f8a593430", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "i486", "colour": "#328A83", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773572855, "uuid": "956a78a8-417a-4492-968b-728794e92feb", "comment": "Malware payload (Mirai)", "value": "c40a7bc5facd6e6d6c13be41efc6f4b47e1aeac05dfa2b4f22b803b969fb31e3a3f3614222ab276827ba4c6a6e2279d2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "i486", "colour": "#328A83", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773572855, "uuid": "e1c37c7d-4e33-4806-bbb1-388643ff45cd", "value": "T1D3E34C57A687F5F0CE420AF8306BAF3299326C371235DFA6E7A4BD62AD54201901777C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773572855, "uuid": "2e71fec1-b2f5-447b-b83b-e4f18ff6b4bc", "value": "3072:6wp9f4OiSm/jITJRdrqutfMccvHZmVcKZtP8YtS8lHKGtBDu/5C5:lySZcvHZoRAIlqq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773572855, "uuid": "e91be23b-1d36-46b2-8558-941f53151e4f", "value": 152300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773572855, "uuid": "08ebad5b-c436-492a-933f-f645e7ab59dc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773572855, "uuid": "72d846b8-6c0b-4dc4-b40a-10ddc1dc981f", "value": "memory_load.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5427fae-2059-11f1-a769-42010a9c0008", "comment": "Malware payload (LummaStealer)", "timestamp": 1773570616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773570616, "uuid": "5fe1f600-d6f7-4eaa-9692-493e24f7763f", "comment": "Malware payload (LummaStealer)", "value": "1b7e7a5cc91792e37306081df0c90714", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773570616, "uuid": "4c984bf3-8b11-44df-b631-7bd561e6db1c", "comment": "Malware payload (LummaStealer)", "value": "69e1c6e6db92779a952338294a7c75782c9ad2c48b57289252e3f5287d1c5bd5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773570616, "uuid": "0b5d015a-b442-45a8-bacd-365fdc99177b", "comment": "Malware payload (LummaStealer)", "value": "956ecad7173e73c6b493af3c0d6b3e26ef060a0b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773570616, "uuid": "8758bef7-c3ce-4923-980f-867a1fc2a9f4", "comment": "Malware payload (LummaStealer)", "value": "fb5a7602c820335934ec5e00900c5cd025253c6112c9b4896c1f0fbf15ccda0849a97e79fed01f6edfa0d3c5a315f720", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773570616, "uuid": "f171fa33-2105-4d03-89d9-aa426e616e83", "value": "T1EF549D0AD76384B1D94704B821CEB37F8A3C162163389FD7DBC0DB94B9775E1993AA06", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773570616, "uuid": "44822ad1-f87b-45c8-83d3-93395686d7df", "value": "f12ef0517c38c05cea3130091585ea2f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773570616, "uuid": "aa4d04b8-a8c8-48da-b336-5abe5b9737be", "value": "6144:YrpZk6ZHYW2Iyu1JB6CVLixRGhRU9Dcrj7OI8HgPxxo0:M+a4QyuR4SqQ/OFgPE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773570616, "uuid": "f55f3558-ecb6-4a6d-b792-72cf0b80529f", "value": 302080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773570616, "uuid": "b12db78f-3662-46bb-b71c-57b023c877c4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773570616, "uuid": "1a5eaf79-4890-4d97-88d7-a5ad2e841e07", "value": "69e1c6e6db92779a952338294a7c75782c9ad2c48b57289252e3f5287d1c5bd5.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28adf0e8-205f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773572850, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773572850, "uuid": "3a7b8859-6f13-411e-a7ae-dd7f168e36f2", "comment": "Malware payload (Mirai)", "value": "5a3734aa6768817206ff3fc9d62241e4", "object_relation": "md5", "Tag": [ { "name": "arm6", "colour": "#001BDA", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773572850, "uuid": "7e30224f-adda-466a-8044-b082ccf4af1e", "comment": "Malware payload (Mirai)", "value": "6a115305812bc468064e50e4795a0854ee2a11ba1980d6029d744e153cf7446b", "object_relation": "sha256", "Tag": [ { "name": "arm6", "colour": "#001BDA", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773572850, "uuid": "42ceeddd-b5e0-4f50-9428-bbdeaf2c48cc", "comment": "Malware payload (Mirai)", "value": "7ef1b231b9ccbe73b84041ac13d2ad987b0ab6a1", "object_relation": "sha1", "Tag": [ { "name": "arm6", "colour": "#001BDA", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773572850, "uuid": "ead4844e-3b64-4362-929d-487be2b48a31", "comment": "Malware payload (Mirai)", "value": "ee40f8a8fc7c91e5f21c05fa5042016decca64e512e38b0eeec318f4be60ed91162ed0c41619191b76197efbbe3e5fb3", "object_relation": "sha3-384", "Tag": [ { "name": "arm6", "colour": "#001BDA", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773572850, "uuid": "66e8b362-66fd-450c-aca9-cb17cc46a3c0", "value": "T1F7043B86AC909E15C6C116BBFA2F018E331657ACE2DF7252CD245F3477CA92B0E3B645", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773572850, "uuid": "1ca4be53-bd19-4b11-9d2f-08d71f268e1d", "value": "3072:3oxUePjtw4KLTg/RlMCHR79DkoSD4XAqRSj0IDg2CQvj0mQaiA7tT4aYDu+gTPvv:qUoa4KQlB5kdUv2JQmQut0a/bhJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773572850, "uuid": "140fad62-2662-475b-b5a3-11977fa07133", "value": 181816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773572850, "uuid": "aeba9ae9-1905-4f42-9cc5-db41b4506bd8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773572850, "uuid": "4b05860d-8276-4266-8ecf-67cf58fbfff2", "value": "memory_load.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2310609c-2019-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773542775, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773542775, "uuid": "bb5a3585-bea7-4414-8b86-0148f8d4aa42", "comment": "Malware payload", "value": "04095b638d624ebc487970c0ad06cdc4", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773542775, "uuid": "3b6c95fd-bfc5-4ac2-823c-9acb1aa56b6b", "comment": "Malware payload", "value": "6af3457051330059b04eea8a42d1ed8f08bf92a29ea981cd5e94b71c2f25c493", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773542775, "uuid": "96c71480-3cc0-41cd-9bc8-12e248aa7386", "comment": "Malware payload", "value": "6acc81837f884f141c33f2378cc19c5244b073ea", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773542775, "uuid": "cff2038d-183c-4cbd-b4f9-27f3532f0c62", "comment": "Malware payload", "value": "b038fd3d0ecbcd45826d52da01dd20b0a937df10c7932042a817556e0711c87c3ff637e1ab1a6b01934964e1d2cc20ce", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773542775, "uuid": "02e81dee-2f8e-4e24-9673-a4590ce9f9f4", "value": "T1E8C3E19D49CAC4668B9F34380B1F6D0BB6DDA1124A1DC4A0FACF9FD43F129A470796E0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773542775, "uuid": "c78f15d6-ae0b-42b2-a4b7-a57083f12404", "value": "768:1ygccv9LqbYXPaUzpQsqL6b6m6a6j6T8hZaQlomqxuKA/zAT65ckwi6E7MvF8WVP:1J3rpam6hgnGC7PUzczaBsf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773542775, "uuid": "b0187957-bca5-4ac4-b793-853b4bb8de84", "value": 119400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773542775, "uuid": "840cfa18-bfa1-4ab8-96d8-e317063f2042", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773542775, "uuid": "e076a4d0-cb1b-4169-b8e6-ff63d69fca46", "value": "Z_Config_Germany_2846.log", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0609fc5-2029-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773549992, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773549992, "uuid": "6740c9ef-66c6-491f-a282-fe9b95a0c695", "comment": "Malware payload", "value": "ca87e50fbcc0a23f75fcb3799c26996f", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "SafeGuard", "colour": "#A33AC2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773549992, "uuid": "ee96415f-f45b-46fd-9129-8f10a7eb31d7", "comment": "Malware payload", "value": "6b0c56540499051ab350a31f417b99859da7ed7286b9e77503711c6aabafbe03", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "SafeGuard", "colour": "#A33AC2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773549992, "uuid": "1f4e2db4-fae5-4175-8649-78657bb7b281", "comment": "Malware payload", "value": "bbcf3c9b3826c01088de026403265db6b25faeed", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "SafeGuard", "colour": "#A33AC2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773549992, "uuid": "0c3a71d3-c26c-4f7e-a761-bb5dbc3ea70a", "comment": "Malware payload", "value": "ffbb9606f8d924a0f7afeaffd5bed83aa427d031464091d8823c4049bb49114bed38c42aeb62f37de29a7ba4b09f6e95", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "SafeGuard", "colour": "#A33AC2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773549992, "uuid": "3272df21-b511-41e2-a5b9-beb215bd4409", "value": "T13846018AF755963FC8BB95338A6A43352662DC12CE839B437888726C6C7728D5F14FC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773549992, "uuid": "1f034c08-68a3-48f3-9803-5916202117ec", "value": "98304:hMdmJoNbJoNnJoNiJoNbJoNyJoNyJoN5JoNxJoNeJoNO83WY:hIAeiHi7L0wHg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773549992, "uuid": "6ffa16a4-31af-4bf9-a87a-8781fb56a9e6", "value": 5572724, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773549992, "uuid": "4d1ddcef-cd1d-496e-acd9-8e8610e4b7e9", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773549992, "uuid": "fe538fff-fba0-412c-a22a-9d2363de7fa2", "value": "SafeGuardPro.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2b36268-2047-11f1-a769-42010a9c0008", "comment": "Malware payload (RustyStealer)", "timestamp": 1773562746, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773562746, "uuid": "03b2815c-ce21-4ee0-96e4-bb8faeb0e914", "comment": "Malware payload (RustyStealer)", "value": "357b8478d59bfce97061923e76f8da2c", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773562746, "uuid": "eb4ba3a6-c077-4777-af4d-529ffe39afb6", "comment": "Malware payload (RustyStealer)", "value": "6b5958033363692844ba1374e3ed89daad416ffe7495a326ca59a70d99a24973", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773562746, "uuid": "1e2ab1b6-a0ce-432d-a61c-364e915caf05", "comment": "Malware payload (RustyStealer)", "value": "9051966a3f375e2967be58aa70174aa7c08fdcfc", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773562746, "uuid": "171dc107-b618-489f-a9b5-991dde623a60", "comment": "Malware payload (RustyStealer)", "value": "bd1bc341f586a0b5b135baa0404327016cdf1105bce6ee9fa265a43f0098fbe899d8be62402164f46d1ee2e343a4142a", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773562746, "uuid": "ac05ae7f-7031-4432-8f94-f1bf028a4e88", "value": "T1BB06231B70D0122FFB13D075D14BDEA2E779F4550623F9FA16A82D220D25BF439AAB90", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773562746, "uuid": "7e0b0a65-f88c-4818-a5d9-abdac008d433", "value": "56720a0219cc1a5225b827e19e3be6e0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773562746, "uuid": "c75cfa71-c811-4935-80ea-96da7f1d1513", "value": "98304:J4px7E480S+zZk1PT75boWRJVEIvDTac599TnwOp4:IE480Sm61PT758wVzDZ/LwOq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773562746, "uuid": "cde0720b-b10e-40e0-9ac0-09531ac0455a", "value": 3685888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773562746, "uuid": "7bb4148d-6d1d-4f8e-adad-9b97e287a252", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773562746, "uuid": "35755a79-995a-4007-8625-76438f758e6e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d15de22d-201b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773543927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773543927, "uuid": "85a9a851-125a-4a95-bf24-557b6d54a8ac", "comment": "Malware payload (Mirai)", "value": "4b7db5da85cd09d3abe9a480e96e5ed2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773543927, "uuid": "c5ffa678-11b2-4de0-8402-d0e49f148c2f", "comment": "Malware payload (Mirai)", "value": "6be78a25411c51901570d314d657ea558d2bc7902ac9fba144020e257dade0cc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773543927, "uuid": "51b9bf78-fc61-4b3d-bffa-482ccfee6204", "comment": "Malware payload (Mirai)", "value": "8fb1069d664e7d89968e35d8df5693b36abd624c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773543927, "uuid": "ad9f6f26-8ea4-409b-882d-aec3f971f417", "comment": "Malware payload (Mirai)", "value": "324d95700ebdbef29b2092a386e2ced3e5997fa7d5ba60d238d49b67d38d6b714cb45e1959fc455d77b04df3d504699e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773543927, "uuid": "15667fa6-fdd4-442d-b0f6-1dd607d3835e", "value": "T1C5D34B46FA404B13C0D51779B6EF424A3322AB95E3DB730699249FB43F8676B0E63A05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773543927, "uuid": "036e0e0e-127c-4d80-879b-1c4def9ed3f7", "value": "3072:ipVBEWVn1d1thYV3e5p0/yvLqafhdnQPIM/9JGy:ipVBEWVn1dNm3e5p0/8LThdnQwM/9JGy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773543927, "uuid": "c98d7977-d4bd-49bf-9e64-651c2ca9bdcd", "value": 131592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773543927, "uuid": "631f2781-165a-4cbd-b816-6074028e02b9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773543927, "uuid": "5736389a-6d77-4cfe-bac3-76be44512d10", "value": "charliekirk.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96dac842-204b-11f1-a769-42010a9c0008", "comment": "Malware payload (DCRat)", "timestamp": 1773564445, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773564445, "uuid": "0534d903-0769-42b9-b8e2-e9274f624899", "comment": "Malware payload (DCRat)", "value": "3e7308939ffb4b70668be022c559c7fc", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773564445, "uuid": "bb092cd6-89be-45c2-b617-d727a797aac5", "comment": "Malware payload (DCRat)", "value": "6c21172e96b44fcf072ce0045353a8f69d9c0099f51baa2f2d3009dbf08e5f5a", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773564445, "uuid": "bce18c7f-44b4-413e-95fe-5a4dea17e5be", "comment": "Malware payload (DCRat)", "value": "ad0b48fd3ad42c9b4ec64ea243ff9fb644394272", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773564445, "uuid": "653a57f7-b024-4abf-8bef-8f107394b3aa", "comment": "Malware payload (DCRat)", "value": "5bf4b5020d9c9bb3c8767700455f88e022ab47ca38629b1ce4efebd629fbdf3c08e3880aa357dcef3cf631b15590dc24", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773564445, "uuid": "effdc213-c646-4ac3-9340-deb466c05bea", "value": "T16FA5337470D1C1B2E5A6103584CACB32A636B062877EC1CB7A9D77F56F603F1623A6C6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773564445, "uuid": "db790a00-dff8-414b-985c-d71d981d7900", "value": "bf5a4aa99e5b160f8521cadd6bfe73b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773564445, "uuid": "30773939-34b4-4b17-88a5-0a8d546a03dd", "value": "49152:OkQTAaYS/v6h3+1uhZcT2NnvOyLXXjFpNXCym/hXmL9W6EppQpl:Oaa5CbhZcT2lvnDFpFW/twU7+l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773564445, "uuid": "2c368cf8-ad76-4c28-97e0-ec9bea798ae9", "value": 2078720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773564445, "uuid": "d1c002c6-2089-4b45-9bea-7c4f7f0fdcef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773564445, "uuid": "c05dbcd3-c1ad-4b1f-8d79-7825935cc8db", "value": "libGLESv2.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc09b751-204b-11f1-a769-42010a9c0008", "comment": "Malware payload (DCRat)", "timestamp": 1773564507, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773564507, "uuid": "7ea6910a-3b57-489e-be7c-1b812d2f570a", "comment": "Malware payload (DCRat)", "value": "e87ff7cc6a718502bca8327ee62a5c78", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773564507, "uuid": "7d9b50a7-fa54-43ba-aa0f-ebc1f264c327", "comment": "Malware payload (DCRat)", "value": "6c74d52824da484e0825bea467fc4926cf0007cbda3850057ee669f98f952df9", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773564507, "uuid": "94fd1955-2f63-45e6-a220-3aabf8d3ad75", "comment": "Malware payload (DCRat)", "value": "8aa89854480e1ed4c2337b853dfe19ac132a794c", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773564507, "uuid": "2a6db190-6f81-43b2-8bfe-6750af308c17", "comment": "Malware payload (DCRat)", "value": "c3455c782fb8ce05b23d2e0f1735df761063c79d5d73d98dee209594a352bd43e0aca5133611d991ef55b4d5b344fbfe", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773564507, "uuid": "06ff098d-b865-4778-80e9-ddebe0514ef2", "value": "T1E1A5337470D1C1B2E5A6103584CACB32A636B062877EC1CB7A9D77F56F603F1623A6C6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773564507, "uuid": "7996c924-63f8-408f-898f-3a6a44756eba", "value": "bf5a4aa99e5b160f8521cadd6bfe73b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773564507, "uuid": "0b848e54-5db2-4c52-8ec8-846764fd2b08", "value": "49152:ekQTAGYS/v6h3+1uhZcT2NnvOyLXXjFpNXCym/hXmL9W6EppQp3:eaG5CbhZcT2lvnDFpFW/twU7+3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773564507, "uuid": "ec4a0a1f-73cb-4e32-9025-7d35d8eafe7a", "value": 2078720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773564507, "uuid": "2e751bb1-53c0-4e96-880b-c4fbc7f38e9d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773564507, "uuid": "dae50bb6-759d-4033-b3f7-4601e543c2f8", "value": "libGLESv2.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3edc6b8-2079-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773584223, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773584223, "uuid": "d7742370-26d2-4a6b-b920-5094f9799557", "comment": "Malware payload", "value": "528a02ce3df043ac495df1844602dfe8", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773584223, "uuid": "baf013f7-4f2a-44fc-bb36-cd15f7eeb521", "comment": "Malware payload", "value": "6caefde626311178946e86ebb0df91359834b3c993a8920eff5a35307421ad92", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773584223, "uuid": "3406a2b2-b128-4dd9-a3b4-96e905e6e25f", "comment": "Malware payload", "value": "85b473fbbed8da05e13eec386874ffd279630cf5", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773584223, "uuid": "526a79c9-7134-412d-83eb-177151b1f542", "comment": "Malware payload", "value": "5ddf0865822c8cc534d74afeeef714a0e9069e758cfbdacf9cbac1ff8bbabe257a5fe563713022ff921532aefb20e49c", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773584223, "uuid": "b230b6ba-30a8-4c61-886a-afc75816bf7c", "value": "T109B300CA596D94ED8A9F2428C15F5C0BBB9DA303062FD1503A6F6F843F32DB5606B5E0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773584223, "uuid": "8ec6a6af-6734-4035-a085-776da1778bef", "value": "1536:ZG9g2ku3Vm+zzQG9k/jokKZn82FRO0pMeqQAckkjjN:Kkujz3FPSeqQpkO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773584223, "uuid": "9a6d6a3e-8f2c-4c0c-bdaf-e3607a4ebbb3", "value": 113554, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773584223, "uuid": "85792288-1d27-4e2e-bdde-2649abcf9d16", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773584223, "uuid": "22a6d0b2-3b5f-4c07-a26c-117b9723da47", "value": "Notes_Updated_v9.2.ini", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aeb6799a-20b2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773608723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773608723, "uuid": "2161215c-82cc-42df-9cae-3113194abfc9", "comment": "Malware payload", "value": "2c9104c25b615dfe6db3e51a51216544", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773608723, "uuid": "4203011a-f310-493a-8235-8fb8395d6bf5", "comment": "Malware payload", "value": "6cf5b801b8a00a278e3ba2490ebda765af3489db71d5490dd17e0a4920edaa22", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773608723, "uuid": "b03f06b5-0703-4ce0-ae5e-e86b799da252", "comment": "Malware payload", "value": "2483aa114f26f71559bcd7418f63408a77ab7384", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773608723, "uuid": "c4c40f53-d297-4c2f-b992-c714e1b306e4", "comment": "Malware payload", "value": "7b39067193e87700e6ec1b907d192fd5b17daefbc091edb8aabf5f7816f3bce285bf3e02f6ea46edaca96cc6967a5473", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773608723, "uuid": "e574930c-1636-44bb-bef6-062c8a6c6c19", "value": "T1A0A604AB22E48569C1FDB23AC0AF8B41DCF36175073BC1EBC59417A89B129C45E7F924", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773608723, "uuid": "e7f446a2-a0f1-4984-a4d4-a20aed5fe31f", "value": "b8399aa8e7b34c992334ad63f681f404", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773608723, "uuid": "5a8967b6-85bc-4196-b12b-65c66509fa75", "value": "49152:Y3BDMNyKXcTCa1C7hoaeKEvj995SA50moXGQRdReVTVezXtdF6UY80LZ8xA0LPDa:PZ9eKRSJLZ8xA0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773608723, "uuid": "8e796eb9-f3ba-42cf-978a-2f9c6412caf8", "value": 10177024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773608723, "uuid": "c82093d8-4647-46f8-8f91-54371aa69fe4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773608723, "uuid": "bb1a23d0-767b-4f8d-bde1-2b7680178d59", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8b15f9c-2019-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773543107, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773543107, "uuid": "0b8de57a-b5de-4235-9966-dbeaf7417315", "comment": "Malware payload (Mirai)", "value": "355daf3a2093496213396e11ec8b99dc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773543107, "uuid": "7563f1bf-7511-4a2b-8e0d-0947b00a9866", "comment": "Malware payload (Mirai)", "value": "6dfa1e31b246ddcc95bd98c8267e2742ec72eb42193b7bcf06a7326df74e2ae8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773543107, "uuid": "d79b4529-0c96-4f64-86db-04ba0738b4f3", "comment": "Malware payload (Mirai)", "value": "bc9052fcfd575d8e6b05a4f3181aacbfaf491458", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773543107, "uuid": "22cd3302-8839-4053-a2a7-0bc530edb489", "comment": "Malware payload (Mirai)", "value": "96ab1a5d8a2d42195293859e25dbfd3411b1f5d19f75e834678ddaab8d6688e742a75f0b41a5874dafb30b4c74bea6ef", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773543107, "uuid": "9deeadb2-4067-4d58-8690-5b63e0184735", "value": "T117D3F756B9919B12D4C321FAFB9E914933136FB8E3F97102DD206F60278A99B0F77502", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773543107, "uuid": "895fd8f7-a718-45de-939a-bf1d26d78e7f", "value": "3072:3SK3FjfipmbcFSkia7a2SGOt056dRgXRWQGuAifOxNxwsq:f3FjKdF5n7a2ZOt056TgXQTuNfixwsq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773543107, "uuid": "5cf7898a-e7fe-4b82-b7c9-8a81628ae528", "value": 137984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773543107, "uuid": "ed31f0d1-2c4f-4f5e-923b-66721d5db7ca", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773543107, "uuid": "18e57643-e734-4e13-a1d6-3339de1c9eb4", "value": "data.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a24d508-205f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773572852, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773572852, "uuid": "63c3d918-91fc-4c23-b875-0e5c6263f328", "comment": "Malware payload (Mirai)", "value": "113d280e892af6cf78606608b251682a", "object_relation": "md5", "Tag": [ { "name": "arm7", "colour": "#30FEAD", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773572852, "uuid": "fc40af08-0445-4e23-86c4-19cf1705cb1a", "comment": "Malware payload (Mirai)", "value": "6e04f6522253e964351457140d39af83eb0371c38d02bf3710392ffd25078db7", "object_relation": "sha256", "Tag": [ { "name": "arm7", "colour": "#30FEAD", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773572852, "uuid": "17c27115-dbee-49c9-8004-fe79a93b03b4", "comment": "Malware payload (Mirai)", "value": "f3431c59688dbd84d6dea89b2f3a9ed791e5ff50", "object_relation": "sha1", "Tag": [ { "name": "arm7", "colour": "#30FEAD", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773572852, "uuid": "172373a9-1235-448a-b733-d54f4ebea3c4", "comment": "Malware payload (Mirai)", "value": "4e45dc730e5ad2ee482a2a9ade6dd518e6cebc2d853a1a1b362ad15d1418063b7345b5b5351849b83e29b0941caaf2c2", "object_relation": "sha3-384", "Tag": [ { "name": "arm7", "colour": "#30FEAD", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773572852, "uuid": "9a3b23c0-3cc2-4d71-aa26-2e660e68276c", "value": "T173444C46E9408E13C5D127B6FAAF414A3332A754E3DBB2068D286FB43BC765E1E37605", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773572852, "uuid": "cf3d4e45-7e17-4ec3-9061-a84f581a44c9", "value": "6144:opOrVEeiOg+wKT/bASaNV102uEV5rI6T+tM/9v7/Pj:oYrVJDASaNV102uErOa/xz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773572852, "uuid": "790d2744-a65d-4902-8508-6467b130099e", "value": 270285, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773572852, "uuid": "ec124a25-51b7-458f-8001-17b166876697", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773572852, "uuid": "bc1267eb-57b1-454b-8b3e-2eb1906a756c", "value": "memory_load.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79ac6548-20bf-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773614217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773614217, "uuid": "3dee6b5f-d878-48ee-acd4-5995d04ba331", "comment": "Malware payload", "value": "8cd687c8e9534a6f3e58dff4f7acf44f", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773614217, "uuid": "9b234df5-6a26-4fbf-b27e-50e2dfe54da6", "comment": "Malware payload", "value": "6e2101fc3bc1c7c05f0086d2d5b382dbd7c87493030d8c966af549940ff188d6", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773614217, "uuid": "d9101d87-4c42-49d6-b955-8a5e7d284855", "comment": "Malware payload", "value": "f407fca3fcc5733c80749686b91be159414510a8", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773614217, "uuid": "0e42789c-1297-4115-8a9a-40270eab0766", "comment": "Malware payload", "value": "52b33124d6f5736e706a88808c5d4e39897d1e362cd1e775de194812588a8f24f1c7d11e4238fcad2bc170914c1b758e", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773614217, "uuid": "cf2f030c-9fb5-4d47-8e91-a7e633614d10", "value": "T142B6F4AB62E4D5E9C15D817BC393BF0184F36179077681EB42D437A8CA3E5C89DFA920", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773614217, "uuid": "99dc6e71-cacc-43e4-a022-a15d647403f3", "value": "b8399aa8e7b34c992334ad63f681f404", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773614217, "uuid": "ccb4e65d-a98e-4d56-b255-c9032dd94afc", "value": "49152:y3BDMNyKXcTCa1C7hoaeKEvj995SA50moXGQRdReVTVczXtdF6UYqvFHohayMKmg:tZ9eYRSYdIIF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773614217, "uuid": "a5f5ce1d-87c6-4115-a381-2abf15e3f55d", "value": 10473984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773614217, "uuid": "34100c3c-154d-4fd8-9875-9b2a0e279788", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773614217, "uuid": "9c32c2c9-ecd8-4f00-9607-7c7d489a8bd9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43cf49f5-2043-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773560869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773560869, "uuid": "d6401b06-0127-4599-a377-4ef86e62ede3", "comment": "Malware payload", "value": "39bc5705a78ef428d15f16365bf47766", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773560869, "uuid": "c6bb1f64-e5f7-4363-907b-5e0edc325513", "comment": "Malware payload", "value": "7158c58e8bf098ab9db5d8ec75e9a3064938c230b2e425130669206193450ffa", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773560869, "uuid": "7f683392-6d2e-4d24-8c70-554fb6f8e4aa", "comment": "Malware payload", "value": "2aaea70fdc3f8750f5d0780e7eb4bf11229f1d87", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773560869, "uuid": "c2a9a744-275c-470d-9074-170128146089", "comment": "Malware payload", "value": "cee70c1c220b35b01fef643c59078736634b76afa4b03ee19d5819d353af8b72f5fdcfa17fed032b443ce300073c955d", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773560869, "uuid": "96846771-fe65-445c-b2f0-ec46cde6c37b", "value": "T18B57335FDC004A97D8BBC870C13CD799A649BE32DF62491392393361A6B36E432F594B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773560869, "uuid": "30452783-8cfb-4a6d-8a27-6d933c360646", "value": "786432:TvDjv34tMnDK3BEL8M95Anqq8ndoylT8wPYNV:TyMuREL8M95Kb8nVuw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773560869, "uuid": "ff3d1578-2268-4241-90e5-6b7321b8e0c7", "value": 29380608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773560869, "uuid": "99d6940e-5fae-4480-bd6f-7862f690b244", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773560869, "uuid": "0e5fd989-fc47-4fb7-849c-bc8b3cf6322c", "value": "YimMenuV2.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c43adf5d-202f-11f1-a769-42010a9c0008", "comment": "Malware payload (Phorpiex)", "timestamp": 1773552495, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773552495, "uuid": "d7f72b8c-dd1b-4352-b399-ad7ac7b10156", "comment": "Malware payload (Phorpiex)", "value": "6040aaab915e00e67d80a1abc1d98143", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773552495, "uuid": "0095676e-161a-4afd-a82c-2a24d447506e", "comment": "Malware payload (Phorpiex)", "value": "74185c5084258b89d490687987171a6e7e0247be4ca5a2dd12607ddfd911d183", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773552495, "uuid": "02177e94-799a-4429-8251-b3de1acbfcd4", "comment": "Malware payload (Phorpiex)", "value": "1096dc4d7479db14bda9fee025e57419e3e84355", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773552495, "uuid": "ebddedd9-c67f-4684-b316-2e5049daf113", "comment": "Malware payload (Phorpiex)", "value": "004ae1947ba3e2ff35d3f91806e1538a87cc881dca3b0a14c44b9672bce6834e086c0612676569b69ea03b129d649089", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773552495, "uuid": "12533949-e0c6-4590-b185-c62ffaea7485", "value": "T1A895EA83BACB4DE6CAC667B496D343356378FD518B1E5F2F6A08C2316D536C4AD4AB00", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773552495, "uuid": "18795d97-4158-4f54-bab6-2eb85554afcd", "value": "e5cdd90f98839995de80308930c41621", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773552495, "uuid": "80c9388d-cb3d-49a6-a802-4aa109bcd75c", "value": "24576:TX+MJ71Xy4KnLqCm29Wu8H/da88JsU3Aot+Ec0xMkwd0MzWsR5:z+MJ71fKnLqGWxHYwd0MzWsR5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773552495, "uuid": "ae9af896-1397-4d97-a0f8-34ae1cbd72ab", "value": 1929997, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773552495, "uuid": "56c95d75-393d-4e1c-bbf5-9d2a8801b404", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773552495, "uuid": "127b7295-3118-4a19-a336-149f353916b4", "value": "6040aaab915e00e67d80a1abc1d98143.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "269d62c6-2075-11f1-a769-42010a9c0008", "comment": "Malware payload (LummaStealer)", "timestamp": 1773582295, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773582295, "uuid": "35bda5b3-1e4f-46d9-a2e0-ad810c0f41c9", "comment": "Malware payload (LummaStealer)", "value": "fadb5b2d6ee0cbadc739ce7181a91408", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773582295, "uuid": "8f202f00-db63-425d-ad04-a7b5db23bd91", "comment": "Malware payload (LummaStealer)", "value": "757d9491cb7a290ba19b8594291632657919e0d5eb966f0741d6f0afef172d8b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773582295, "uuid": "2c1a4b4d-bc85-43f2-8961-a04af4bd9c09", "comment": "Malware payload (LummaStealer)", "value": "f02721feb08491007a39b5f76096bf94f30cafc7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773582295, "uuid": "5be7bb8f-5e0d-425b-9c9a-0b186817bdd1", "comment": "Malware payload (LummaStealer)", "value": "396b7b5d043ffe52f4d832d25b5e0984435716b9a36ecbcdeffd918bd4e1574c85c9af9085d9f97df52bc750ae47f477", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773582295, "uuid": "2304587a-b85a-4aca-9ba0-0bb0a1c97347", "value": "T116547C0AE76344F1C94B40B132DEB37F9E38662057348ED7DEC0CB85B9279D29976A06", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773582295, "uuid": "4f53ced2-90ab-4d97-9376-6f1851adfc24", "value": "f12ef0517c38c05cea3130091585ea2f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773582295, "uuid": "4b5f8cb9-a616-472c-8da8-aea6917cdf3a", "value": "6144:F7OrQ0hUFver4GaPojyx+Vvb7hY4VivddaY7:VgCeUGa2Evddak", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773582295, "uuid": "382aa027-fe73-4212-ab93-a4acf80c3f24", "value": 294400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773582295, "uuid": "ab32f269-7c98-430b-a9fc-a1f966dc398f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773582295, "uuid": "01fdb165-bdaa-4cc2-89da-1534db625974", "value": "757d9491cb7a290ba19b8594291632657919e0d5eb966f0741d6f0afef172d8b.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51c59607-20be-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1773613721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773613721, "uuid": "039c3115-e524-423c-8e68-a78371d1f788", "comment": "Malware payload (Gafgyt)", "value": "65c3d924417beaceffc5f2f7c612c532", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773613721, "uuid": "c1a60e15-b07f-4530-9d40-6996513f78aa", "comment": "Malware payload (Gafgyt)", "value": "76f0338622519a764eeea04c0ef8176aa3ffa35bae8d350bc7f358ff024f3d21", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773613721, "uuid": "aba14a64-4beb-4d50-bc95-826617d180ea", "comment": "Malware payload (Gafgyt)", "value": "e288d3f0e6e9d22c2296778eca8d38317b1d1d70", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773613721, "uuid": "f5c63b81-e4a8-4e28-bad2-717d3c1ddf83", "comment": "Malware payload (Gafgyt)", "value": "1e08e1c75fcd95717042cb13b15d133fd76d11f7fe35e405ef3a96eefe21a12398f38214e0473bbbd1b2b72417679965", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773613721, "uuid": "235a75d1-536b-4c59-a88e-53db064aed53", "value": "T1C3E3980A6E328F7EF269877447F38E31A75977DA16E1D680E1ACD5401F202CE641FBA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773613721, "uuid": "b23b776f-4057-4504-b2a4-b1e0d4d55918", "value": "3072:vUbaW9ziFDT/nWECnjzj5FUgkKnO8UJ7nuOW/:vUb716P/nWECjzjUcO8wnna", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773613721, "uuid": "d8803d27-75cf-435b-8e59-c2d059841890", "value": 149544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773613721, "uuid": "885910f5-421a-45d3-b529-86febd6d5444", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773613721, "uuid": "e00721ec-da35-444d-ac4b-288f44ac0d22", "value": "data.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "526eede1-20be-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773613722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773613722, "uuid": "1683c6d8-0588-49eb-8eb2-23df043d20a4", "comment": "Malware payload", "value": "76c1d82d4895a75d61ecc289a5a1489c", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773613722, "uuid": "56001b4d-1e05-453a-b6f4-4af97ae0fbb2", "comment": "Malware payload", "value": "7895cb4222daa6065ec06bcd61ed4fc0f826126d60383bf58ec39c289fc6f228", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773613722, "uuid": "f701f29c-7fd6-4b7c-9180-066cc55f1648", "comment": "Malware payload", "value": "cc522dcded415a973cfc0bcff3d1b2724cb1e6cd", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773613722, "uuid": "a1071b86-d905-461e-bee1-223d07b3da61", "comment": "Malware payload", "value": "1fdd448cdc716111815ae60a124ec3276044c996dfbc595c23cd1223fdc2a45cc13bc8ea143e453c9075afc3cb676f5d", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773613722, "uuid": "b3486d48-789d-4ce5-aed0-4b535a7697fe", "value": "T174F098DDB1293938F804BE4234D28B942210F6971E5F4F89149D2921FC466783037F48", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773613722, "uuid": "5bdce469-f27e-46a3-b7fe-5fd1cfc82319", "value": "6:S6FcUBRX5UCuyU4IUf6FcU1+X5Uh0yU1BFIUG6FcU4ksX5U4LyU4IIU4v6FcUeGX:lDIIHFIqGnI6kGedIIeJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773613722, "uuid": "5d2d0937-d34b-4852-bc4f-b2aa141d0108", "value": 471, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773613722, "uuid": "271be8df-6f79-4874-8bf2-9335ee025ded", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773613722, "uuid": "798bd7df-b705-45d9-afea-5f259c3a9e92", "value": "t.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "447132e6-20ca-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773618852, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773618852, "uuid": "4f3a749c-4b27-4860-9c86-41ce28a4b8de", "comment": "Malware payload (Mirai)", "value": "e1f1adcb81da0e1e19bd904b99cc66cb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773618852, "uuid": "d3fea684-ac9b-4e4e-9682-237861cce770", "comment": "Malware payload (Mirai)", "value": "7b920ee300713002d5efda920670ae0a8ddb21b0eed74ae370f1a6762749d40a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773618852, "uuid": "68b88896-b27d-47a9-9884-f51f65039ea2", "comment": "Malware payload (Mirai)", "value": "479cad636d9a226090c2f2235d726ae2a214ad63", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773618852, "uuid": "aaad47f7-88b6-4f7c-9e90-704a3a1b52bc", "comment": "Malware payload (Mirai)", "value": "3229d6754c151bc360e6b458b1d0d7776f21b83b00cadc846042c8db669f2f63a828876c7e66365c8c15d540942815f5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773618852, "uuid": "17ca4e08-7fe2-4431-a632-dee3343a272a", "value": "T145F2E017C9FCAA48C965803C4BFFBD5D2240E5CFD1E6CDA4C8D4A06AF0E1B58743A25A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773618852, "uuid": "d2a0adba-e581-4305-9684-afdb3eb90137", "value": "768:TT7+FNO2Uuir7K4EoczsrMhtn2QlUe/W/1iGxnbcuyD7UtQRje:TTAI7RYz4MhAQlUUW/txnouy8tyi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773618852, "uuid": "e3421833-f2fe-4869-bbb3-2b8d630b3ffd", "value": 35320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773618852, "uuid": "5d9883fd-f0a1-4d68-8c13-5fc50afb4c23", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773618852, "uuid": "9ed3d3fb-b24e-4ef7-8c3e-d6ed838d229b", "value": "px86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25b7e2d8-205f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773572845, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773572845, "uuid": "80e55353-6d25-45fb-9398-a5cc7a186bed", "comment": "Malware payload (Mirai)", "value": "357de003895a2d8865e5ffb5e654a9d7", "object_relation": "md5", "Tag": [ { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773572845, "uuid": "9beeb520-f2f4-44de-99ed-12a1d71cfadf", "comment": "Malware payload (Mirai)", "value": "7bd221072c350c63e59a2353389ae78f89d74d4ae09cde79e22d9c9170c0e9fe", "object_relation": "sha256", "Tag": [ { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773572845, "uuid": "7bf8c0f5-4700-41f1-b317-d6083031b3d7", "comment": "Malware payload (Mirai)", "value": "24342a1f099bda65b1bc789eaff5f063c299a773", "object_relation": "sha1", "Tag": [ { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773572845, "uuid": "50cc285d-159c-46c7-93c0-9c4c40f58edc", "comment": "Malware payload (Mirai)", "value": "ce7e602ec05a84a9c4cc6cdc1212370d28e5742c09ff8ece946c2b4af9f2fd9549b2b8d23d258ef5dc9822773d5908d2", "object_relation": "sha3-384", "Tag": [ { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773572845, "uuid": "9271cf33-7659-4758-9428-e300b7ed5ec2", "value": "T184043A86BC91EA26C7C112BBFA2F018D331653ECD2EB32029D245B6477CA85F1E37645", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773572845, "uuid": "32743998-39dd-49f1-b5cb-80e634b44f2e", "value": "3072:zA8Z29UtemDhqPN63wbpGeG39884uLd9ae4Qmc/vFVatE0CwXqKv508:LZ2OtkTGeQE72Lay/g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773572845, "uuid": "429accb0-a67a-4c72-ac91-60aeebde6e00", "value": 173744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773572845, "uuid": "c926dd2e-eba4-4934-ae30-30a9b4d53c21", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773572845, "uuid": "75c2d082-9978-47dc-8e46-664f82f0599f", "value": "memory_load.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41c01b07-20ca-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773618848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773618848, "uuid": "3e39434b-adff-49c2-98b2-f0fc4841d286", "comment": "Malware payload (Mirai)", "value": "57f13c34705e062e59ea539e8030b09b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773618848, "uuid": "b99029b9-f1f8-4a5d-9e1a-ff7793b9bdae", "comment": "Malware payload (Mirai)", "value": "7c331899da1e7ed68c39f25fdef0f697fb4c3e77808475aaeedd339bc5660124", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773618848, "uuid": "0eb1cd74-a919-49b8-9512-adefb6ba502d", "comment": "Malware payload (Mirai)", "value": "77962eb4ea1ef2904b51cfc819e579734e28bf07", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773618848, "uuid": "3f636c28-d1a3-4f44-a246-af245291bd5e", "comment": "Malware payload (Mirai)", "value": "e8d5107a5a37a567f29cf64d989ee81128ed28023a27c28107db4e12a59dc6770b033b74e5d435feade27ccc1c75cf7b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773618848, "uuid": "a16b2ff4-7616-4ac2-bc6f-01961926b827", "value": "T16903F16CF2813A5ACA7F9F3E555E02B3732154F033952A4A132108CCCE59936F9A907D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773618848, "uuid": "ab9bd2e4-60f2-4c95-9790-21fbf46259e1", "value": "768:aybMN2q8qb06Ds/qFj/Vi4iHxdjM8QpU/XIHtJShvl7AMX/3vWielyQWf:aygzPb0CV+zj0WwHtJShZrv3+llyB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773618848, "uuid": "6c219103-396a-4892-af5a-426530ae2804", "value": 40024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773618848, "uuid": "9c9ec05e-40f1-4e49-a03d-4700351a8282", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773618848, "uuid": "1f213bb9-ee6d-47ce-98a3-ba2a83bb344d", "value": "pmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ede3129-20bd-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773613421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773613421, "uuid": "ddeb5bc1-adbf-463d-b6b4-b374374870d5", "comment": "Malware payload", "value": "abf044288c2ae64b453fbfbddafcfb65", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773613421, "uuid": "51f14561-1e27-4143-a5cd-7dd589e224d7", "comment": "Malware payload", "value": "7fa2482d25fc54bfc10c8187327151a63d288e9df6922b6cb30e2638ed364f5b", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773613421, "uuid": "871b1393-6de6-4b2a-8b72-50f108d35007", "comment": "Malware payload", "value": "8e41badcd587f5b4b05d89b541b3b2f17cad7479", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773613421, "uuid": "5a95d2dc-115d-4046-913a-0ac8a73afb86", "comment": "Malware payload", "value": "1b03827bce9afc881d45c68956d76d243c07acb5d0a525f0815b2cb417a6b975ac8fe0b3cd9d0393050e9d479f596ca7", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773613421, "uuid": "da132023-9bdc-419b-9ed7-cae823ee2e96", "value": "T19AA606AF2EE0D579C1ED853AC092CB4184FF61FB0F37F1DB969407A88A125D05D7AA21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773613421, "uuid": "b97d14e0-85c1-4c60-a70a-46bde0bb406f", "value": "b8399aa8e7b34c992334ad63f681f404", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773613421, "uuid": "a0f4214c-c177-40c2-8eff-7025bab0c0eb", "value": "49152:i3BDMNyKXcTCa1C7hoaeKEvj995SA50moXGQRdReVTV9zXtdF6UY6clkNN/VTLhV:9Z9epRSBA/VP15", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773613421, "uuid": "d9b43e7a-c5e2-4549-afd4-64892954e2ec", "value": 10368512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773613421, "uuid": "9681386c-5f88-4584-8489-ffe1bf88c036", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773613421, "uuid": "52cf9bb2-1b2e-4386-b65e-198a1a3e72ec", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ade6c9d2-203b-11f1-a769-42010a9c0008", "comment": "Malware payload (Snojan)", "timestamp": 1773557611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773557611, "uuid": "f594bd91-f653-41f1-9ca5-509ded61407b", "comment": "Malware payload (Snojan)", "value": "3754f825c5c71518b60addfde7e31f2b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773557611, "uuid": "fa5e4bec-f9e7-4a9b-ac6f-26460ac41d13", "comment": "Malware payload (Snojan)", "value": "81c941262ec4dabcc47b95756dee9a5e962c2a957796401d3ec2c3c7d9918d7c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773557611, "uuid": "aa292f54-9e0f-46c5-8670-702e0a8c847f", "comment": "Malware payload (Snojan)", "value": "a0a87f98cd7e27ea4a2eedab0bd896f3d283aebd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773557611, "uuid": "a5aff911-d172-4ff6-b026-5b4bb3999308", "comment": "Malware payload (Snojan)", "value": "7391af728b864e7468c40673e64011c8a109d15ef2d64d788e3bbdb3dbccf4889e85cfb36bde7f4b970a2191d8564a25", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773557611, "uuid": "ebf41584-1e72-4813-af4c-c62aeb1dd194", "value": "T173D5DF342DEA502AF177AF3D8AD07596DA6EB6A33707994E10B103C60B23B42DDD153E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773557611, "uuid": "a5648f3c-6bcb-44c5-a13f-79d26094419b", "value": "2dd2758f0793bdb29ce229a2432eb81b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773557611, "uuid": "8b6ee7bf-e07a-4392-83a9-7298cddf867b", "value": "49152:4kQTAKYS/v6h3+1uhZcT2NnvOyLXXjFpNXCym/hXmL9W6EppQpoa1ZFC/k:4aK5CbhZcT2lvnDFpFW/twU7+oU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773557611, "uuid": "7bd46a60-2321-44e7-94a3-84cd147c5ac5", "value": 2883584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773557611, "uuid": "bf09ecc8-4adf-40fa-9f20-7ca8b4581616", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773557611, "uuid": "a8e8e660-0beb-4c9d-bab5-63522f2feb98", "value": "81c941262ec4dabc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3b9a702-208c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773592437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773592437, "uuid": "d2447e68-440c-462f-a47b-a24ce4baabd6", "comment": "Malware payload (Mirai)", "value": "898f238d38ea6535ef2ffc44df4608ec", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773592437, "uuid": "36ca4f2c-bbca-4539-875f-2d07270c0a9b", "comment": "Malware payload (Mirai)", "value": "81ea772d178fc43be8403c9d50ce632fe5724f81bfc5fcec19d7caf076f98e24", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773592437, "uuid": "32711291-7c86-400b-86df-5f675beacb33", "comment": "Malware payload (Mirai)", "value": "8e387d815cbcc5b6881c3105f87883390edfcf5b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773592437, "uuid": "b38b0e57-5e7e-4cd1-aa46-1b0a5a58b4ea", "comment": "Malware payload (Mirai)", "value": "988407d3002e3f9c20bbecea7bb3219ce32619fff23b33c0f4de8290dd8d0ea9d078f57ae157a7b273b2ce5853fddbc9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773592437, "uuid": "d7b6142e-a103-4505-92d1-060a311e4896", "value": "T118042A86BC91EA26C7C112BBFA6F41CD331653ECD2EA31029D215B6477CB85E0E37646", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773592437, "uuid": "3b8c0d99-cb5b-4d7a-8d8d-6fed8de14e8b", "value": "3072:J82n5f48oPOo/DB81F8wlEygbMcSP84Jqx7MVK0gxzK6DNo093aqKv50q:nn5w8o5KqygRe4PDmQy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773592437, "uuid": "6dd61429-2544-41c3-9194-65e21df95ba1", "value": 177556, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773592437, "uuid": "bdd6c33c-d7c5-4dd2-b62f-89bfc3b4e105", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773592437, "uuid": "63994e90-2711-444e-bb82-90140fc89d4f", "value": "memory_load.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a7afa89-2067-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773576450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773576450, "uuid": "67651e77-b263-494b-873c-04c0f11402a2", "comment": "Malware payload", "value": "1bc0aea3c35232641bd08b96821c48a5", "object_relation": "md5", "Tag": [ { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rugmi", "colour": "#64B88F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773576450, "uuid": "5cce70d9-3d9f-4b05-afab-a5f1f4db540d", "comment": "Malware payload", "value": "84004a02471e9c24cf5b6bde5bc9d35dc44514a7db112901746e9d871c913c47", "object_relation": "sha256", "Tag": [ { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rugmi", "colour": "#64B88F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773576450, "uuid": "d79f881a-18fa-4e6b-9439-9be7b05811ae", "comment": "Malware payload", "value": "11d09da7b55c0faa502f71cd3e9fb2451cccceea", "object_relation": "sha1", "Tag": [ { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rugmi", "colour": "#64B88F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773576450, "uuid": "d759618a-dcfc-4aab-8d76-6627fbfe25cd", "comment": "Malware payload", "value": "65e0bb58e2d6b1a537aed6612da350cd3c8360f6e725faab4f05d6d1851ae4d7bc8959eaa6ab98f78c2bfc9090a75d0c", "object_relation": "sha3-384", "Tag": [ { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rugmi", "colour": "#64B88F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773576450, "uuid": "bc4a4e17-203f-4404-9961-bbbca9dd0562", "value": "T14A467C552AEC4354D0768E39C996CE9BC7F37C542B3243CB0061A2AF9FB3BE50539662", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773576450, "uuid": "2a63b426-6cfa-490a-bd83-dab091fe3e88", "value": "511e84a713b81c45523831aabd208e9c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773576450, "uuid": "b287fc3d-7622-43e9-84b4-f6e5f4cd3ef1", "value": "98304:5eVG5T98ZkddTzv3z3FLOAkGkzdnEVomFHKnPAr:5eVG5T+ed73FLOyomFHKnPAr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773576450, "uuid": "8334784c-a435-44c4-ab2d-ecf61bde7ace", "value": 5574472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773576450, "uuid": "30f39bde-0fdb-495a-a5f8-b0b79ce75401", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773576450, "uuid": "2ed12270-876b-45d5-bfe7-7aaa6a94511d", "value": "mfc100.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "770c5e6a-2037-11f1-a769-42010a9c0008", "comment": "Malware payload (Snojan)", "timestamp": 1773555801, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773555801, "uuid": "f95fab23-9c53-4205-9afd-058aec186cce", "comment": "Malware payload (Snojan)", "value": "65cdd793d298d38b425cbc94ec39ad58", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773555801, "uuid": "00508b5c-688b-4229-b044-e7ad69d8e684", "comment": "Malware payload (Snojan)", "value": "84e7e468f7222bd5b8f3312355c3d699872f21cfa6e125a7dc177eda50918959", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773555801, "uuid": "e81cbea0-f206-4b10-b503-66ccf52b7963", "comment": "Malware payload (Snojan)", "value": "dde5e26d05fcfffae1cc7dc2395287d8dcde1447", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773555801, "uuid": "2b2673d9-7517-4a82-9103-8768d3a455a9", "comment": "Malware payload (Snojan)", "value": "62602fe0c4f39dc22fd69b9473a027a273e9d124781af6ab8831f8a666de60859c3d61cb2d6d473c278e43b7bee7278b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773555801, "uuid": "2c28f6b6-b525-449f-8ead-4cc8ce9a8ab6", "value": "T1BAD5DF342DEA502AF177AF3D8AD07596DA6EB6A33707994E10B103C60B23B42DDD153E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773555801, "uuid": "86831a9e-c952-41d7-8778-6486db649145", "value": "2dd2758f0793bdb29ce229a2432eb81b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773555801, "uuid": "bf9e2981-9f12-4801-bec8-17d840ce55e7", "value": "49152:vkQTAKYS/v6h3+1uhZcT2NnvOyLXXjFpNXCym/hXmL9W6EppQpoa1ZFC/k:vaK5CbhZcT2lvnDFpFW/twU7+oU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773555801, "uuid": "90439ea2-e212-4170-9c6a-2416daa2aa50", "value": 2883584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773555801, "uuid": "b4224156-01d6-48cd-afbe-3647c38c3f75", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773555801, "uuid": "342750bb-e4d4-41ab-a551-33e2d31a51f9", "value": "84e7e468f7222bd5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43c3f0b9-2049-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1773563446, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773563446, "uuid": "f23aa2b4-93cf-4040-9d0c-98f6509db40b", "comment": "Malware payload (SalatStealer)", "value": "c3e58740b2f61e4eea92697ceeff06dc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773563446, "uuid": "5c8b9646-1c86-4630-90b6-3255ac66be94", "comment": "Malware payload (SalatStealer)", "value": "8651bf3f8f38d547530e0dcdd89da904e14ee7bd87c05f5ff429038ba73013ef", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773563446, "uuid": "57ebf7f3-c469-42af-b521-773f90c1f667", "comment": "Malware payload (SalatStealer)", "value": "ffb12e074516427a3060f1ea1bcc0817e17a4d7f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773563446, "uuid": "7b20eacf-a8eb-4e48-b1fb-9333a1112c79", "comment": "Malware payload (SalatStealer)", "value": "68c791ba0b6632bfc46a51fd0c8e84ec0ba9cf925f5d0abe3c9d5a81aeefe7ca72ea37d80c397a583e0ccad7b8c7bce2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773563446, "uuid": "91dde91a-ba7d-4dfa-b955-3aa5d5d19584", "value": "T192D65B11FACB94F6E9035831516BB23F23315D048B28DB97EB487E2EF8776A51C6A305", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773563446, "uuid": "b4467673-4ad5-4997-bfd9-96fb6f6d841b", "value": "98304:HUgvXoLDbViKilnGJ5Yi2jocVi4AG20C3E:jXiNi5ji2MciwJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773563446, "uuid": "e5a6cf79-aac8-493b-a601-4ad1052f723e", "value": 12924928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773563446, "uuid": "2592c20c-f1a2-41fc-bd7a-c5bc7a4e94e4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773563446, "uuid": "c885be67-1996-4d12-8fc2-b469e25c2a8e", "value": "yesamsevo.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80e578c7-2031-11f1-a769-42010a9c0008", "comment": "Malware payload (RedTigerStealer)", "timestamp": 1773553241, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773553241, "uuid": "d19f4d4d-14e5-4f80-a472-04071509e641", "comment": "Malware payload (RedTigerStealer)", "value": "2fd20a93d20a36f3ea93bbff87149db2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedTiger", "colour": "#F0D50C", "exportable": true, "hide_tag": false }, { "name": "RedTigerStealer", "colour": "#85B9EB", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773553241, "uuid": "531a23d3-2e0d-4f5a-afc6-feca4c012b0c", "comment": "Malware payload (RedTigerStealer)", "value": "868256ef2bfc57b871c3829ca9d71602378c0c0ccf755315b8fa14d84b931a85", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedTiger", "colour": "#F0D50C", "exportable": true, "hide_tag": false }, { "name": "RedTigerStealer", "colour": "#85B9EB", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773553241, "uuid": "48ea4080-ca66-4f39-8ad5-a04f9f8d6211", "comment": "Malware payload (RedTigerStealer)", "value": "67007de35e713e24ae86a391745354816fa92100", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedTiger", "colour": "#F0D50C", "exportable": true, "hide_tag": false }, { "name": "RedTigerStealer", "colour": "#85B9EB", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773553241, "uuid": "670e119d-e2e9-45bd-8dde-1d385f5a6fa7", "comment": "Malware payload (RedTigerStealer)", "value": "6d322b4c4ea8ef53f090de78345614d8ee761b0597879b22b2eafc16e6b70e77fdabfedbcafbf26497f9ed5263195e26", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedTiger", "colour": "#F0D50C", "exportable": true, "hide_tag": false }, { "name": "RedTigerStealer", "colour": "#85B9EB", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773553241, "uuid": "a4d3d80f-093f-48f7-9fc4-4a4da7fe39ac", "value": "T1AF0833087B486889E65893368212CE39DA94BC0A639F854B17F41C273C775DFAAFDF41", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773553241, "uuid": "ed259ae5-f633-4430-9b39-36660bf52ee3", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773553241, "uuid": "dea20f47-2d94-4bb5-a3af-64225f6feeb6", "value": "1572864:CaKVWPjVnsVd1AEJ5Rh1+BDDy4gds8KN2xCCoeSqja8+CM/UCLs64:CzWKVd1AY5bADDxgds8OfeSqj7CA6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773553241, "uuid": "dfbbe169-5daa-4109-bf4f-15ce5b6716ea", "value": 78948458, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773553241, "uuid": "8f953a5c-20f8-4e94-ac8e-0874e4b10157", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773553241, "uuid": "61c87e62-e8d6-481c-b17f-1e9dd9ace187", "value": "HMC-2.2.4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27246122-205f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773572847, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773572847, "uuid": "31660bf4-828c-45db-87b3-720686a77d70", "comment": "Malware payload (Mirai)", "value": "5abf39e93048d726c66f0ccc32de6343", "object_relation": "md5", "Tag": [ { "name": "arm5", "colour": "#C2EE0C", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773572847, "uuid": "121f3ad0-7e75-4db8-9f5e-ff38c8914aa2", "comment": "Malware payload (Mirai)", "value": "86d8af01d4b2b7e5c2f400c1b6a1d0ab0b4d38e1419c7566a7eeed3d4433a2a9", "object_relation": "sha256", "Tag": [ { "name": "arm5", "colour": "#C2EE0C", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773572847, "uuid": "726914dd-876a-47d2-a212-8216bc3f5a7b", "comment": "Malware payload (Mirai)", "value": "094611b4624c8273d6ed5c6bbe85545ad72e349b", "object_relation": "sha1", "Tag": [ { "name": "arm5", "colour": "#C2EE0C", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773572847, "uuid": "faa5ef8d-f246-41ba-b7b5-df3b618c0fe2", "comment": "Malware payload (Mirai)", "value": "f331e367a316d658f4ca79f83f0d6b00ca851812b73a39f3560f1094b612ea84d707608ae46e5631a6429f3f497c8193", "object_relation": "sha3-384", "Tag": [ { "name": "arm5", "colour": "#C2EE0C", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773572847, "uuid": "f1320903-8402-41fc-a85a-bbc18d1bce2f", "value": "T122D34B86ACA1DA29C7C113BBFA6F619D3315A3E8D2EF3106DC24076876CA45E0E33745", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773572847, "uuid": "82751cd1-d0b3-4e35-8298-a0b92c2db817", "value": "3072:n8xe/IsRkTMX0+jPFT8AFBvHfPgGP184Z+OjZ7c67mNMjqKv50:AOIKkGjrfX6n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773572847, "uuid": "fda756b8-65b6-4453-abcd-bd21f8a2a18c", "value": 133760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773572847, "uuid": "430e5749-939d-4ac0-ab07-e139ae4e1264", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773572847, "uuid": "4c517353-520f-4f5e-ab69-0c5b176db3f0", "value": "memory_load.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82f296a9-20ca-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773618957, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773618957, "uuid": "68c51d55-8542-4529-ad30-469d4d02feb0", "comment": "Malware payload (Mirai)", "value": "ad6332bc78b179346db0bac11438d9a0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773618957, "uuid": "f0276787-8172-4fae-8aee-8c4ffa8bee20", "comment": "Malware payload (Mirai)", "value": "872860e186e030b79c60683afbd1d6714aff97295241b85ce3c24ee2bfdb62f4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773618957, "uuid": "644c5e20-55aa-492c-a8c9-80ba1c7ae4dc", "comment": "Malware payload (Mirai)", "value": "e0b1aef248959b50e3d8def79d3fc1ff4a3f583c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773618957, "uuid": "60d6d30c-5185-4535-9f00-4d25ab341281", "comment": "Malware payload (Mirai)", "value": "5572617b738151f2faf92f0f65eca53ce60c5a2b90fbc03aa343d7d6db8c233fd48aaf6d235134e5566045268c40f51f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773618957, "uuid": "69de1003-f60e-4cfa-89cc-36ceec6f3b50", "value": "T12F530195B296024293E04E7ACD5999C16D701D7CF8BE508023F8CA188A7E6F72BFD255", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773618957, "uuid": "49bcd432-7521-49a4-afdf-661a301f10f0", "value": "768:gSalDl+sgE7KyIDCcV3cYFSPZ2fdC9ElV7vdhKhA/7mGoB9q3UELLPPk805d6cvR:JaBl+skHRqPZEdj7TRxLNtcv64r3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773618957, "uuid": "8d5457d0-e2b6-41fe-aacf-a0f616b824da", "value": 61860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773618957, "uuid": "ccd1e2ca-00f4-4e1c-8393-a96f01b212ec", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773618957, "uuid": "91bf57ef-e877-4385-8242-02b331ac0edb", "value": "parm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b11f29c2-2042-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773560623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773560623, "uuid": "c0a72ab8-be84-4e40-a829-f12577bb7c26", "comment": "Malware payload", "value": "b79ab227419f86206847456ebdef8adb", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773560623, "uuid": "66556931-ee0a-4481-ab7f-f2a31e599a24", "comment": "Malware payload", "value": "8821b1819b5923e403f74dc10ec5a5c8c747ac03ad69f295bbfd6e8a6db86b58", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773560623, "uuid": "a093d4b4-8461-4a03-ba6d-2602aa480eac", "comment": "Malware payload", "value": "644b118649ba2465b04494d7c4c6f5e6865def7d", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773560623, "uuid": "851a13e6-c7e1-4cac-baa2-5aa181abb423", "comment": "Malware payload", "value": "1630ee259fffabda550f7a1a1aa054e14f3e0ed2c92c58987ecc4c289803931300004d174b74e950af244145e8520870", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773560623, "uuid": "3e83551e-afaf-4256-bad8-359f7950708f", "value": "T135925CA912096C79BBC0CE7D9F3C7F0CADE4C1C02118A3ACBA4F39704A2069DDA0535D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773560623, "uuid": "38c9c298-7f11-4d22-b2e2-34b2219bd99b", "value": "384:fR10M3vgRjGlsaq7NzsO9a4cbddrME8jyfzsO9a4cbddrME8jy4:fRtmjfxzsP4cbddr7zsP4cbddrk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773560623, "uuid": "32257e58-d65d-4975-8301-6fa281736466", "value": 19499, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773560623, "uuid": "58ddc61e-334d-4616-902b-3b5a171b8f38", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773560623, "uuid": "2507fe44-8989-431c-88f4-37c740a60cf5", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2ca7aad-203c-11f1-a769-42010a9c0008", "comment": "Malware payload (QuasarRAT)", "timestamp": 1773558049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773558049, "uuid": "85b29e7d-eb11-4505-ad4a-8de8fcbfc0d1", "comment": "Malware payload (QuasarRAT)", "value": "785b7e8a6836ea8df1a3f3f8d1f2d21f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773558049, "uuid": "0a0cccdb-136b-42a6-bc52-c8fe1ffbfb41", "comment": "Malware payload (QuasarRAT)", "value": "8ad4bb9191f72cf8cb1c0aa5a96a0f51dcb4c2340a7c34a49da61b2432eb5088", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773558049, "uuid": "4d52a024-b4ca-4ea1-855d-4e57fddbccf6", "comment": "Malware payload (QuasarRAT)", "value": "90d9112233023f4d30e8bd29bd8f6648810dae84", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773558049, "uuid": "f83940d5-d00c-469d-a89b-3f1d3cab789f", "comment": "Malware payload (QuasarRAT)", "value": "786e4260c1d41b3fdb33ac34178aed087787bee9b5486f199f1807042f20dfc0e777cfe164c7ee91108b82a5b706c35d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773558049, "uuid": "67b89736-a5c3-4988-a42e-c0b2969ae628", "value": "T1F7F55A143BF81E77E66AD272C5B0501663F2F82AF363EB0B9581667D1C53B805C216BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773558049, "uuid": "68e9d22d-e2ed-4c48-bb58-9074a1556618", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773558049, "uuid": "0fa857d0-e950-4e59-8ce4-a67ada78e256", "value": "49152:8vnst2zlaWX6bPmlccBGyQxE3fTtoG0+xvJVroGdOTHHB72eh2NT:8vst2zlaWX6bPmlccB3QxE3fA+N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773558049, "uuid": "9bae6ec2-229a-4989-b489-14c92bd179df", "value": 3334144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773558049, "uuid": "3886c859-bb75-4a27-adcd-d99e2bed0208", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773558049, "uuid": "7a83d96f-36eb-4bd7-ae71-5c0319f2b88d", "value": "contacthaven.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37501d2a-205f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773572874, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773572874, "uuid": "49731eea-6227-4bfa-9532-201fff3cc887", "comment": "Malware payload (Mirai)", "value": "e94b944770efd2eb05f62df35077e8c8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "x86", "colour": "#3BD92D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773572874, "uuid": "ccf13f1e-f2ad-4cac-8118-d337f0406ee7", "comment": "Malware payload (Mirai)", "value": "8d385e7b91c3cdd6c17a071f238602d4837d5deed5f213f93d02c15674367a10", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "x86", "colour": "#3BD92D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773572874, "uuid": "2af37046-3571-4039-947b-99e1cc146656", "comment": "Malware payload (Mirai)", "value": "2aeabd92af4c459cbc76e7354b168e3d9d640bb0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "x86", "colour": "#3BD92D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773572874, "uuid": "0fd4b982-5a31-46b2-bc3d-1dd15c8dd78e", "comment": "Malware payload (Mirai)", "value": "ac7d2754473a463bc2128c939b6490c97db24392c34f09fd5ad22eb70153d8415893b52f9eddbdbc1194555bdcbbf9bc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "x86", "colour": "#3BD92D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773572874, "uuid": "2cebc58d-6b0d-42a0-bda8-38588897f6c2", "value": "T137E36B8AAA83E1F5DC06477830AB9F329A77E47B112BDBC5D3B46D72AC4020181173BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773572874, "uuid": "2a1462f9-14ca-42ce-b75d-2dbc83a867d2", "value": "3072:eDwKI0/AW+dFPTNdg+hRIvJd1EF9TOTSIdUjCHhe4Ok04G9RoPUeUT/3IcKlDe/s:WlI0/7+dFbN+kIp2e0DoPC/c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773572874, "uuid": "f93a6bf3-a11f-4b8f-b9f5-3c32ff200946", "value": 152784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773572874, "uuid": "8f12ccfa-8d16-48d2-9718-c830197c13e6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773572874, "uuid": "61e63613-a716-4ada-934b-9933cc5c413c", "value": "memory_load.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1d05108-208c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773592434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773592434, "uuid": "c5f1e86b-94be-412d-9832-5c19241362ec", "comment": "Malware payload (Mirai)", "value": "855d659a82c62331ea38408465464d14", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773592434, "uuid": "b68883e3-2f29-4a86-ad4b-75407a5b1fc6", "comment": "Malware payload (Mirai)", "value": "8e66fb8f1abfced1af373c0d376c7b520ef185c70e9b740271ce12a05aea8719", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773592434, "uuid": "4c6f16c6-54e8-4a86-b81e-0b4f81d29237", "comment": "Malware payload (Mirai)", "value": "d2a09a922990c0dab229f08ec1003780e1116a49", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773592434, "uuid": "627efd78-e2a7-4fb3-908f-3e23855fa83d", "comment": "Malware payload (Mirai)", "value": "88e4041f0b4f2a06626a5d77f856e4cff9880815b2620e6bbeda3a6468ac9841d70c2d274f8e1860b46ff5e935737bf6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773592434, "uuid": "7ec0124d-532a-4eb5-be3d-5bdcb64dd493", "value": "T113043A21687A2D2BC1D4957B12F78362F1F7278E34B4852D3EB10E4EEF1826075526BA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773592434, "uuid": "f0e87614-e245-4294-a11b-23a8cddae184", "value": "3072:u7bTrWjUmp4AdvfjYJVwNfsUw0ldl30jq/kvN5sLK1DP5k7k:u7EndjYJVa6kriNRSk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773592434, "uuid": "63f21e9b-9786-4935-bfaa-003cc2658e17", "value": 177136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773592434, "uuid": "3303fbc5-9b0c-4434-862d-c7e5a000bfc1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773592434, "uuid": "14a8679e-d448-40e9-92e1-0d9edd197547", "value": "memory_load.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03633d4b-20bb-11f1-a769-42010a9c0008", "comment": "Malware payload (GuLoader)", "timestamp": 1773612301, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773612301, "uuid": "0cb48ad5-36a1-49f0-acee-c2e6e332c436", "comment": "Malware payload (GuLoader)", "value": "45f9654de3f416edabefad32d9c5d0d2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773612301, "uuid": "0e86fd7b-60f4-4521-8271-5f23fe492a25", "comment": "Malware payload (GuLoader)", "value": "8f88a31d389b61548519017e9368119657beafbbc357dcc090d9a8bc8f95bc32", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773612301, "uuid": "8a1b01fe-5a2c-46e0-933d-09ae13ab21c2", "comment": "Malware payload (GuLoader)", "value": "5cc8d9da8965e1e958e3cb618e85628c756e192d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773612301, "uuid": "31c71769-ed5b-4e7a-9d72-337438596224", "comment": "Malware payload (GuLoader)", "value": "0ce0f99e7e2390c86c0886be25a82b3c96df37b829035fa0dc955ae1440214780d13cf0a2847cacec84023f719da0bd2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773612301, "uuid": "649e4aae-38af-4303-9ac8-dcce01f6c1e7", "value": "T1B87523C53AB0D867D1760E701417D7B91B6EBE132D33F646E6E06E8B386E2C0E5B8241", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773612301, "uuid": "1405b461-28fc-45d1-85ca-9d9591c37f5e", "value": "1f23f452093b5c1ff091a2f9fb4fa3e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773612301, "uuid": "e4f0ce25-8fa5-429a-9ff8-0d503849129b", "value": "24576:+OG2C8FE6F08kntuBAVY2mc4hD5ZsNmVzXazR9SExecT40zcJi4XCz/:5JrvktuBG7GZsUVzolx/49J7XCT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773612301, "uuid": "300340d1-6211-48d6-a5b0-d3d28bae81e3", "value": 1574832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773612301, "uuid": "ee801649-ff93-4953-bb97-ee9d5f7dacd2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773612301, "uuid": "c1bab910-d77a-4db9-aadf-a97111f1473a", "value": "TT Copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "162bf9bb-20a9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773604601, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773604601, "uuid": "46144492-40b7-4877-99f2-e05d4c982e76", "comment": "Malware payload", "value": "1a7547a0d00b830a8ffdb7af7ee5822c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773604601, "uuid": "46e1501b-0839-4f96-bf01-0578f5969174", "comment": "Malware payload", "value": "905e0e98fa529395b6ccfeb38fefabb10913fecbc66f5d1d8097dfb34c0b724e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773604601, "uuid": "481c69b1-1b4b-486e-8d67-e4b2db8e3194", "comment": "Malware payload", "value": "b7e727b1af92bc829585ab77e1ffde0fde279ae6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773604601, "uuid": "08c2dff9-f946-4684-bbb7-fdb02d6f3464", "comment": "Malware payload", "value": "533d881243dd38e7c7990779a167e37ba203ad970f3ab38cf66a17d1adf428f2cc5cac6bac3379fda078f6c52f70c0e7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773604601, "uuid": "288ad90f-35d4-4a0b-b2d7-225c68c951b4", "value": "T167464B03ECA555E5C0AEE23589629253BA717C496B3123D32FA0F3782F77BD06A78750", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773604601, "uuid": "e8303761-e8b1-442f-81ea-b8543608c7e0", "value": "49152:OYyzHPoQQFqWlM1c9cJPJD9mYY1vm78newwvgAlYaRtpVWlAg9H4PKOKDKWFnqg6:OxIgRDSG8ew8lFR0WI5qgCDEu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773604601, "uuid": "17dbc335-f598-4d9e-8d47-57b240177e08", "value": 5714212, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773604601, "uuid": "407acbca-8ec5-4d52-b5d1-1f97aef77733", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773604601, "uuid": "3be5b0dc-d169-4900-ad26-661ec734d9d1", "value": "botguaymolonl7_arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a26b69c3-203c-11f1-a769-42010a9c0008", "comment": "Malware payload (Cobalt Strike)", "timestamp": 1773558022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773558022, "uuid": "07200d34-34ef-4f50-aba6-bfca86a1ad2f", "comment": "Malware payload (Cobalt Strike)", "value": "8fdea261460bd3b3253c9e9cefb3da8e", "object_relation": "md5", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773558022, "uuid": "26091c02-02f7-4246-ab72-a791a4435c5f", "comment": "Malware payload (Cobalt Strike)", "value": "905fcd2566eb979d9ca4e63c7113346d86707f6ae70e325d0e85194acd721bf4", "object_relation": "sha256", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773558022, "uuid": "e0516da8-81ce-4593-a482-45e819d428ef", "comment": "Malware payload (Cobalt Strike)", "value": "09ab41c6a8a5030ce40168bdf416959c6b6f6bf6", "object_relation": "sha1", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773558022, "uuid": "476c6838-6871-4561-afd2-bf843d005539", "comment": "Malware payload (Cobalt Strike)", "value": "52f77c9d6dc9bd590acb28fcd35dad916a2575d79e24447c870b687f20d26deea5481728ab37f992d6191cbfea71da9a", "object_relation": "sha3-384", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773558022, "uuid": "cec5f286-3ec1-44d6-bfa4-f388169a0a1c", "value": "T179743938BA25DCE4CB2FB1B489212E4551713C0B8730E69FA68525DB5E372D0EF3D928", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773558022, "uuid": "a446f98c-436d-471e-96ca-260248d86803", "value": "9a7e4883d5793bf81d0e5cefa9ed71c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773558022, "uuid": "c89a2edc-8225-42d7-a10e-9715b04d57bf", "value": "6144:Kdbu1J7PCaXxMLGxKWR1mlkVl+lIzohdMxB+RNGrQLFR461+nO7zs0IBVLd:muqyxMLNplyon0BB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773558022, "uuid": "061c4546-7b57-4128-a2ad-b9804f2fc40b", "value": 364544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773558022, "uuid": "e19d7cfb-9838-423f-b154-f98c480c8b03", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773558022, "uuid": "1eae52cc-3756-46a4-8cc6-f6f63749a338", "value": "CobaltStrike.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2bc0eed-204b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773564518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773564518, "uuid": "8d3df851-87b3-41f2-a8db-12a4a08811a5", "comment": "Malware payload", "value": "aa1f91e304b3f2442b436025850543d3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SentinelStealer", "colour": "#3032EC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773564518, "uuid": "9a97f471-a969-48cf-85d4-6bb535f5e0a1", "comment": "Malware payload", "value": "91218784a16bfc24ca13351e5bb1da23f6b7fa0484a14fec5fca3b18b18eef54", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SentinelStealer", "colour": "#3032EC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773564518, "uuid": "feac2f5f-024c-4f41-89f7-cae07b62c582", "comment": "Malware payload", "value": "4ffcf3c38612414a45a165f447b02d0c58d6a2d6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SentinelStealer", "colour": "#3032EC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773564518, "uuid": "d2dfeb2c-f22c-4f9f-86e9-3482740b07d0", "comment": "Malware payload", "value": "90ec3cbf1f17cba9af2b2f1e2e32deef11bec7aee40fe307a853ae6d8b28393029896fc04b3d6c965960cd3bd6a33e27", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SentinelStealer", "colour": "#3032EC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773564518, "uuid": "5cc8645b-a541-4051-8f51-5ca5c9c9d190", "value": "T1CEF4DC9C766072DFC857C876DEA81C64FB6074BB931B9203A42715ED9A4D89BCF180F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773564518, "uuid": "20a2978e-8394-425c-b3e0-8f79028bc931", "value": "12288:QK+dBuieGV2SEnZUighdqxrxM6bASjDrbJg9wyEHORfsiNHx0JVDe/L1iWQYOaZy:idkiFYfZaqxrxM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773564518, "uuid": "3462d1e3-779c-4511-8618-c381bf132649", "value": 772096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773564518, "uuid": "9325c796-a9a3-40cf-b047-ff5ef8aeb72e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773564518, "uuid": "86a3de4d-6ee5-462f-bbf6-82e356fe793c", "value": "SentinelStealer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "616a9658-2081-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773587548, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773587548, "uuid": "ecb1bccf-4cea-499b-93d4-67a547e3c42a", "comment": "Malware payload", "value": "1913b71374fee4778cfb341d7442c47e", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773587548, "uuid": "9ef38519-314d-4e8b-87a1-d56c9b62f818", "comment": "Malware payload", "value": "91a4278df997ad37ead2333b61cea248891201378436ae6a22b3954761341ab1", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773587548, "uuid": "e6b2b8b5-45a8-464a-835f-85dbc48b1c0f", "comment": "Malware payload", "value": "6e0175ee462774603dfab931f4d343463be89f09", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773587548, "uuid": "1902bb2d-d189-44a0-acfd-f1c226940283", "comment": "Malware payload", "value": "7da77961e16e39ddfd61f2a515d370b1eb45a4dd9368e70463579a6e541157fbff30a88c1da814afa943b0dba59ab5f4", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773587548, "uuid": "6db91391-3d5c-49bb-aaf2-5fca77a62acf", "value": "T130C3EB6C02CB01D577B7A8C4CBDAAD4AFF582556051CC744772EEEE02F114E8F0AA6AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773587548, "uuid": "2dcf1b87-5ea0-4a99-8cc6-83a8ef058778", "value": "768:68IrfTLxdD357xsdjPuoocRrpnknLsBjg0ZjaTokAsi7mVciAQaUlPPQSTQnoWxk:j4Fvi0DR/w956rMxFaO6MHXU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773587548, "uuid": "8ca2b175-d2ab-4c7e-8213-4f1d29d6bec5", "value": 124880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773587548, "uuid": "626ba427-b1d1-4936-9a26-304d85b3fd3b", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773587548, "uuid": "1ae3aefe-b46d-49eb-bdc8-620b6be8ae5d", "value": "Backup_Monthly_v2.3.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bbe3651-20b5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773609926, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773609926, "uuid": "8bc95ad1-0863-466f-9418-75aa178ba183", "comment": "Malware payload (Mirai)", "value": "15c2e2808a916a65ac4da5dc76ba4417", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773609926, "uuid": "eab0ef63-e33c-4c7a-84f6-6dc006c172e6", "comment": "Malware payload (Mirai)", "value": "930acf8cd72e3f5edfe5eee163e0e701708167bd72e20a5a1641648cf2078579", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773609926, "uuid": "ab139ed2-e7c3-4001-8cfb-3c2e037ced30", "comment": "Malware payload (Mirai)", "value": "156ee9b37b55e880c9675fdd2d0ffce0ef213cef", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773609926, "uuid": "a60aa453-f4d6-4a6a-a261-83959d897fba", "comment": "Malware payload (Mirai)", "value": "dd000e4b21eb1ac2eeacb66758a39462fa06b5618d8deff89f79b0151638a56dca4447b5cff5007545c1c3977cbb70a3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773609926, "uuid": "b553e5f7-f8e3-46ae-8d20-8388b619b662", "value": "T1CAB33B477B208F51C769D6300AF387566BBA22922BD2994AF32CDD007B6535C682FFD4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773609926, "uuid": "bceca180-a1b0-4fba-b565-40625d51e7ad", "value": "1536:udIPqLD7dKF6B5Xq41MqnqlmdrTMwBID2LgugrcIjbGjEeZqSj9WyXeRqDuydxKi:s6qLDvJldBID2cVajZZgyOqDuBjW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773609926, "uuid": "8f7b3d52-32f6-4419-9955-b57bd7f14a1e", "value": 113916, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773609926, "uuid": "ce0de75b-641d-4b86-8290-1e1e92f28b78", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773609926, "uuid": "45ccb344-d1d6-4d8c-ab82-f58dd8b1c4b1", "value": "main_mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ca8c968-20ca-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773618866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773618866, "uuid": "0a4da98d-bbba-44e9-ba08-62a6cabd66da", "comment": "Malware payload (Mirai)", "value": "c0a9a8933607d59f5d5daee74403df05", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773618866, "uuid": "f8b5600c-6e5e-460c-ad91-b3305d94fbb1", "comment": "Malware payload (Mirai)", "value": "9387fa1e8fe1a16d96e968e1ea261d9e487972e046dc183aca9abbcd1a3a63b7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773618866, "uuid": "0746b575-830a-4600-a1f3-b03df1279a36", "comment": "Malware payload (Mirai)", "value": "07ddc52d55badcfb75ff850894304738674bb6cb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773618866, "uuid": "1ec297c4-f6ca-4ae4-bf3c-b342d1d5fcdd", "comment": "Malware payload (Mirai)", "value": "d3837bfd5308d2a413e91165a882504cf61420d4d2e10fa499e279372ed3b3ef6e7127e0e8ed1c3e95a56b5f07255ec7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773618866, "uuid": "6f1a2628-c2cb-4dbc-ae99-0901eb423474", "value": "T10B535BC4A743D4F8F95605795133B3336B72E53610A9CE8BC3A8BA32BC52911EE1B25D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773618866, "uuid": "3b1fbe28-e554-4a09-a62e-082bd8c01db6", "value": "1536:iJ1cbpvrvokOkeu9MPQNqOr6dkl7vCBI9PyTCavNuMFVtKSSBdU:iJy1vrv9euuKqO7qC9SCwkMMd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773618866, "uuid": "9fd8786d-efe8-4d34-8cbb-07b11ad2d7a0", "value": 64592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773618866, "uuid": "2e79a8bc-f408-4204-b821-a84726b25793", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773618866, "uuid": "2f4da899-534c-418c-9fdd-c5f6836e55d7", "value": "px86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2445be99-205f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773572842, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773572842, "uuid": "52c62373-902e-42df-9c6e-b09916b3547b", "comment": "Malware payload (Mirai)", "value": "68a68d7d4e208feddbb2a2e6990c524c", "object_relation": "md5", "Tag": [ { "name": "arc", "colour": "#C3096D", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773572842, "uuid": "43e97b3d-397f-4f87-b37c-fb2022fa2992", "comment": "Malware payload (Mirai)", "value": "93db33a4836bac98a8cbfd108488cf328845f615ca1d9602778234beaac9c034", "object_relation": "sha256", "Tag": [ { "name": "arc", "colour": "#C3096D", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773572842, "uuid": "cd658c95-363e-4828-a700-66b960d9b0f2", "comment": "Malware payload (Mirai)", "value": "78f3ff133e6e97b2b55191ec08c6df84dd708398", "object_relation": "sha1", "Tag": [ { "name": "arc", "colour": "#C3096D", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773572842, "uuid": "e9990849-0098-44de-a24a-52ad727c8b09", "comment": "Malware payload (Mirai)", "value": "3ddff3f926f4f939fea98d0572e7dc6660ab0d3941539adbdcb106471bc36d82ad83ebf8e417dc02978c8b691e37d570", "object_relation": "sha3-384", "Tag": [ { "name": "arc", "colour": "#C3096D", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773572842, "uuid": "ea845e25-dd0e-4865-a273-8fea3f508e4f", "value": "T1C1E318B56458F6FCE8E110B8F01314E725E1882C3DDEE4E2B1879177EFB9748A429D4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773572842, "uuid": "cf273cbe-273a-4840-8bb5-cbbbca1c607c", "value": "3072:7pGoKqWThdxOaYaVQkUgAihDec2xsuTdvPNjWZ5js2TnMQ:7TKX1dUag62zThP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773572842, "uuid": "76cac55f-e0a4-43d6-95dc-3316c07552b9", "value": 157272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773572842, "uuid": "19e44661-1243-49c3-9b8d-a6d3424d9845", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773572842, "uuid": "40272295-ac8f-4b17-b569-f05cb7d4a1b4", "value": "memory_load.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab565bb4-2022-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773546870, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773546870, "uuid": "1e361dde-104b-45e3-a4db-6f9b4c395e09", "comment": "Malware payload", "value": "06f5325811050e0e76ca40be71d045ca", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773546870, "uuid": "fe82cc26-21aa-4580-9a3a-15626ad0d1a9", "comment": "Malware payload", "value": "94b9af2c6eaa9f357893f0915cd60baf6161ac98daa10aba14c033c704d41b50", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773546870, "uuid": "ac6fe93b-8667-4943-95d3-3879314ad602", "comment": "Malware payload", "value": "7e4d474fe4b24fc0585fdde89e39c477eb933933", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773546870, "uuid": "b77900c4-ced6-4e79-9608-b3527b883dda", "comment": "Malware payload", "value": "2ae236a71614cb93b29a8e4c6a5806cfcd8baa7335848cbd34e69bb3364ba453f66a514a2bf1cfcbfd488d5f354b572a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773546870, "uuid": "4e5f6e6c-1618-4dcf-8024-07ff5c4d3b0a", "value": "T1A3B62366FA407F97C4A841784AC6C77163F2E248E202476B7B9893A8FDBE2544F50FD1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773546870, "uuid": "cbe313c1-ef45-4f4f-8d27-3543e28d9e7b", "value": "196608:xKwpvSLd2dqBKNaDetiNd9YR69TepusM5msk7xO7tpDjOAgn2:xVpUd2dqQNaNsMksf5MO7V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773546870, "uuid": "f9eb7fea-fadd-4b66-b77d-6e3fe0f9f8fe", "value": 10999887, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773546870, "uuid": "324ad4b7-3684-45c7-a121-8a0faa4c850b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773546870, "uuid": "d47f26f5-c51c-4c38-8322-0567e2d26ab8", "value": "javavm64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70d4469f-2042-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773560515, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773560515, "uuid": "8192249e-2ea4-4e7c-a8f6-b436202c10c7", "comment": "Malware payload", "value": "b664e5cba4e5d75feb04e071fc54ba7b", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773560515, "uuid": "f26cf970-fa5b-46f4-83a3-c762e5b90926", "comment": "Malware payload", "value": "94f0212ea3040dd579837c12f2dd03de4424f5f9648f4af95505930b8961e200", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773560515, "uuid": "ae960db9-c74f-4070-a70d-bc27d5003cd3", "comment": "Malware payload", "value": "62d3ada083c82574733dd0da401acfecb672189a", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773560515, "uuid": "51709a59-3ed4-42c6-8446-e9cd381d547f", "comment": "Malware payload", "value": "0ee703851883c207be3a68bfda18b39851a84ac9847401c88de8ec1bf82c68fac283c1d0a4ca2efba030dd7d1d407a4b", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773560515, "uuid": "da69d61d-6a3e-4a00-8b0d-78bb1721e59b", "value": "T17D925DB512896C79FBD1CE39AF3C7F4CADE8C2C42124A3ACBA4F39215A1166DC705359", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773560515, "uuid": "95d9de31-0831-446c-8bcd-283279e1dc64", "value": "384:6FcuQpWx+BL0SWL0g5zsO9a4cbddrME8jyfzsO9a4cbddrME8jy4:6F8i+BL0SI02zsP4cbddr7zsP4cbddrk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773560515, "uuid": "a80436c7-5a4e-4b3e-8643-8801b2a7e6b3", "value": 19499, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773560515, "uuid": "edc52f27-c620-4f65-9431-49fda22e7745", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773560515, "uuid": "dbd1b531-25f9-4049-9de8-1bc69948ccdf", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55831650-206d-11f1-a769-42010a9c0008", "comment": "Malware payload (LummaStealer)", "timestamp": 1773578938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773578938, "uuid": "b429d0ed-0074-43d1-b3f9-341cac9201ae", "comment": "Malware payload (LummaStealer)", "value": "26e000074ab34fb38b40656b622aed8b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773578938, "uuid": "f585be77-e12a-4b5e-90e0-05220e91c2a8", "comment": "Malware payload (LummaStealer)", "value": "962bfa5c220d92dc077c156e903e642246481cd5b57e98992105280a792613d1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773578938, "uuid": "3787119d-e7f4-471e-ae5c-383bc4063b49", "comment": "Malware payload (LummaStealer)", "value": "cca3c37b90400b892c536dde0979f3d4a88ff740", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773578938, "uuid": "dc01ee29-2a09-46a5-9b20-6f5485fd18de", "comment": "Malware payload (LummaStealer)", "value": "3b86e7d396b9a53157e9190c7092a11dadb1d46c22ac960ef99f2c54377d056fe95eeb2376d28ddf805b98264cdea4a8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773578938, "uuid": "e6a6b25f-5e9e-410c-a2d7-d86fbe675a50", "value": "T143B47CC4BE8260B7C8642C300466B2B72E741B615325DDFB815738D2E7F6E73A2725A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773578938, "uuid": "2dd097c1-f70d-492b-bb15-a952b2a35162", "value": "87276645a61980fa58d8085fc4df7bae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773578938, "uuid": "15ffd218-2779-4641-8415-392e1cc586c0", "value": "12288:i4bZS+74XGs0vyBTbjcA2usBmdOcDbNbzIG1bK6q137vNXDCpcY:i4bZS+70Gs0g4A2us/ezIGm6qx7VWO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773578938, "uuid": "8b407b91-7fa0-47f7-810d-2b22c34fe63a", "value": 503296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773578938, "uuid": "100da7f9-8658-4e1e-9023-d6934c1d9688", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773578938, "uuid": "5751fa2a-4a00-4815-a3f1-1cb228e45d10", "value": "962bfa5c220d92dc077c156e903e642246481cd5b57e98992105280a792613d1.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a472013-2049-11f1-a769-42010a9c0008", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1773563457, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773563457, "uuid": "beffb9e6-0059-486e-a61f-ae603299558c", "comment": "Malware payload (Gh0stRAT)", "value": "6a149f565123f3b700f6ecaed19267fc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Farfli", "colour": "#2E1E78", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773563457, "uuid": "028368ac-ccb8-4d1e-9c74-d21e9dcda5d3", "comment": "Malware payload (Gh0stRAT)", "value": "982da6dcf5d6db9f2ab26c9cbf62d30d7a5038753e356539a289d04ec66a38a5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Farfli", "colour": "#2E1E78", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773563457, "uuid": "f1f23554-9c9b-4fe9-8d24-df8883c69636", "comment": "Malware payload (Gh0stRAT)", "value": "7731b9080ebf7d51ea3de8244538bb45de7b1a04", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Farfli", "colour": "#2E1E78", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773563457, "uuid": "38403034-00d3-404d-bb75-b61e4e619d76", "comment": "Malware payload (Gh0stRAT)", "value": "54814ed714278e5efbae3ae101ecc611c1f39629d63f29521f36014ba0c745f490456d536065ed971c2e9b9360fd36d4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Farfli", "colour": "#2E1E78", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773563457, "uuid": "0a4b95f5-038e-466a-86f5-c91fb187579d", "value": "T1CDD423F11958D82FD1A441B7EA5DF87235E1DCC1A8A10F229AF17A1CB7D900BF938A35", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773563457, "uuid": "db190044-9dbb-42e4-ba8f-01950e18266d", "value": "8d06ff0f301182c5ba233d45a52ee9ad", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773563457, "uuid": "404e0781-5161-4ab9-98a6-ff33476d1c7c", "value": "6144:PQJf3uMxrbLgEN6S7KzA5x3S5+y3D82oC0UdkgxgfOq:4J130ENL7kArI+y3XipfO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773563457, "uuid": "b9d6acaa-f20b-4e77-93eb-0851110cf29a", "value": 652782, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773563457, "uuid": "b6c62d30-f25c-4052-b15a-955ac0e753d7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773563457, "uuid": "90e4b48e-e4b5-4968-b159-407cc665281f", "value": "wininet.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3857c2f-2074-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773582075, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773582075, "uuid": "6005bfd2-c7a6-4c0d-98e0-faa00d27a117", "comment": "Malware payload", "value": "9c31fe73455f22cf758994e0aa6bb85c", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773582075, "uuid": "4aa8ad67-03c3-408a-9204-144e35b79549", "comment": "Malware payload", "value": "991bc33adf6e07583c78140bc589c1eeee1d53748055c3c70d5b03f65539ecdd", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773582075, "uuid": "91f5b9fd-7775-4621-b91e-a620318aa6b3", "comment": "Malware payload", "value": "ce13d1f68c3a2138d1eeeae54901ddbabcc4f1ae", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773582075, "uuid": "cc72e879-6f1a-46c2-a307-2e82d08e761d", "comment": "Malware payload", "value": "1e07291f211d4631fce8c4a5ad0b3915291411a294fb9cf689da1c240511576802ac1eb57f3c3a86000d92ad1cd84059", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773582075, "uuid": "1a86611a-3265-4c8c-b5f9-cd5710c94492", "value": "T1E086F107ACB000AAD0399773A9F770D6AA65B8A8573333C35F52F3791EB16D12A72315", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773582075, "uuid": "08317916-26af-4f09-85cd-79fa725f08e7", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773582075, "uuid": "90102d42-b7c9-4f8c-a345-b5ac8a015df4", "value": "196608:/mDUOW88ExD42wqlTPLGl/QQ+WHxY0P/hAeaCJJd72/5zpsFly+mqt8+G3Zfmz0Q:/mDUOWDExE2weTPLHGIMR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773582075, "uuid": "851afaf0-c1a0-43f5-ba88-d489867bd8b6", "value": 8176640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773582075, "uuid": "c06a837e-9eb6-4cd7-bc2d-73c6eeebde69", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773582075, "uuid": "8f55ffac-a2bd-4da3-ada2-9fcdc64176ba", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99168b05-2084-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1773588930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773588930, "uuid": "97c93010-841c-4426-9fad-ef0aa0bd07e8", "comment": "Malware payload (AgentTesla)", "value": "01928634bb1ffed201f8e5fe68cd8585", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773588930, "uuid": "9e26d521-997a-42dc-922d-5b67b6653c78", "comment": "Malware payload (AgentTesla)", "value": "99f9f9125484b63c3abd922c0cdbad4ee8b85366f5fcbc2b391379a2295a2701", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773588930, "uuid": "4719477c-784e-4b8e-af59-a6d8150ab7d1", "comment": "Malware payload (AgentTesla)", "value": "df457985c30a944b6d177c6ef79f34011e2944d0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773588930, "uuid": "2637337a-f60a-45f0-8563-4a6eef46d308", "comment": "Malware payload (AgentTesla)", "value": "4946b165a646eacbd951a951ad4a3ee254a1a2a4e58f7ec8f28dc51e0cdf07c25f583fe147fcb07522c1a3f0bfed8c73", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773588930, "uuid": "bb7438fd-074d-4318-8fbe-487361fe26b1", "value": "T1C835AE027391D062FFAB91334F5AF6115ABC79260123E62F13981DBABD701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773588930, "uuid": "c116e4be-8170-4416-8f18-8058f383e905", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773588930, "uuid": "cc9dadd2-313e-4406-a8ac-9b0abf4d6c64", "value": "24576:J5EmXFtKaL4/oFe5T9yyXYfP1ijXdafs4eax0JX5Qv25HRT:JPVt/LZeJbInQRafuXF5Qv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773588930, "uuid": "93a12984-6bb3-44d0-b576-7cbda440e27a", "value": 1120256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773588930, "uuid": "1ce9f8b7-7417-4eaf-918d-b54d1f138134", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773588930, "uuid": "6b81ed6f-9716-456e-80f3-e3e27ed73c25", "value": "Payment.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd2c091f-208c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773592426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773592426, "uuid": "49fb1a2d-db60-4e61-9fb6-37a5886858b1", "comment": "Malware payload (Mirai)", "value": "1a4b8a306617363a48a9d17b99e280b8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773592426, "uuid": "8c83a351-ae8b-498d-a108-a45c32663442", "comment": "Malware payload (Mirai)", "value": "9ab18357f6d7310c37f8a1a48941fffbdedb7376083eb41703cd8692701ed210", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773592426, "uuid": "24f1bddc-c3b7-4351-ac75-3e9c4e1b05c4", "comment": "Malware payload (Mirai)", "value": "5bd93c2f51154791bc21110849814f6a3a34f9e2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773592426, "uuid": "bbf8d4d8-def6-4e8e-8288-84cba68be53a", "comment": "Malware payload (Mirai)", "value": "7f1486c44832bd5a3eb4bfe4e48536413b7dd770b42d6a415f9717d9db70bb425f268f6914ed706572c4f51ed4af2a97", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773592426, "uuid": "deb76c32-3e45-4faf-8327-2b0d91ce7381", "value": "T166F35C02BB284A47F5970EF5243F27C183BFD99065F1B6847A4EAB0E4271E322556ECD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773592426, "uuid": "13871254-48a6-45a8-b43f-1c9cec0a3067", "value": "3072:iB7YjtQbm8phA3x4XFEw6Rc0JAQ+owUl5418ZCNqRv5CRQ:LtWdXFEwMcBowUl541LQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773592426, "uuid": "63b72b04-1f3b-43bf-9f53-f74e60abfa5f", "value": 169460, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773592426, "uuid": "76656478-10c1-4542-8c09-6e30d8c72193", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773592426, "uuid": "47c90e2f-1a25-433e-a78f-ecb6147f714f", "value": "memory_load.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fde17f77-2086-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773589958, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773589958, "uuid": "0b81968e-de23-44fc-91e0-32bf435728d9", "comment": "Malware payload", "value": "d8a8ca91363c62c3def5ddbec5621494", "object_relation": "md5", "Tag": [ { "name": "autorun", "colour": "#301521", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm:Win32/AutoRun!atmn", "colour": "#27F539", "exportable": true, "hide_tag": false }, { "name": "xred", "colour": "#EE58FE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773589958, "uuid": "af56983f-b2dc-4b43-9ad1-83e15ee6562b", "comment": "Malware payload", "value": "9b2dd6b539336506d71d98f840e902cdf0f60b1cabf3d163a725453a8eb97aca", "object_relation": "sha256", "Tag": [ { "name": "autorun", "colour": "#301521", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm:Win32/AutoRun!atmn", "colour": "#27F539", "exportable": true, "hide_tag": false }, { "name": "xred", "colour": "#EE58FE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773589958, "uuid": "9c369fa6-e111-4360-a908-4438d2ee9f0c", "comment": "Malware payload", "value": "21c362dc1ff693003579ea40b31def3a090220ee", "object_relation": "sha1", "Tag": [ { "name": "autorun", "colour": "#301521", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm:Win32/AutoRun!atmn", "colour": "#27F539", "exportable": true, "hide_tag": false }, { "name": "xred", "colour": "#EE58FE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773589958, "uuid": "0f9dc6bc-a758-486b-a8d9-c338c95bbf68", "comment": "Malware payload", "value": "00fd4bbc746d761ce4077ce4c459de966bdf5de463fa3f117c55cefb65158d1ae32e3e99eadd0029cf3e4dd1dd8bc3f2", "object_relation": "sha3-384", "Tag": [ { "name": "autorun", "colour": "#301521", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm:Win32/AutoRun!atmn", "colour": "#27F539", "exportable": true, "hide_tag": false }, { "name": "xred", "colour": "#EE58FE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773589958, "uuid": "82226a33-267b-4de6-980b-cdd68dc59c1c", "value": "T17235AF22B2D18437D1731A398CAB93B49839FF512E35A90B37F42E4C5F396816D25E93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773589958, "uuid": "9011d21e-45fe-4ecc-8d15-fd013c849e85", "value": "332f7ce65ead0adfb3d35147033aabe9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773589958, "uuid": "1eaa7e01-357d-40ef-a520-5acb62815080", "value": "24576:InsJ39LyjbJkQFMhmC+6GD9zsDJ2C++XbhwMrZALFMYy6:InsHyjtk2MYC5GDe2C+kTez", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773589958, "uuid": "f107cae7-9ad1-4210-bd88-d09d169c08d0", "value": 1160704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773589958, "uuid": "8e9f68fe-46a0-4d7c-9d84-7a0486b1f0b9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773589958, "uuid": "bce93b91-c395-475b-8d89-27570ea13085", "value": "\u901a\u9053\u8d26\u5355\u9519\u8befb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb341c69-201c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773544400, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773544400, "uuid": "f05e2fe8-ac44-4c9d-92ea-4df5861ff6d3", "comment": "Malware payload", "value": "f76b7bdbceb13e075de1687c7df0fb62", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773544400, "uuid": "8ccf4e73-48ec-473c-97da-6337f7a43c2e", "comment": "Malware payload", "value": "9cd22d56230c0529889813c99eec9221a81e49908c22d565651f9d4c2cc42f9e", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773544400, "uuid": "75782bdd-2657-4904-b87b-cd7f362c6332", "comment": "Malware payload", "value": "cdb1f4b19772aae02e98dca962b10886f6206a8e", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773544400, "uuid": "b541270c-3d22-4fa3-9805-fbd3d17e903c", "comment": "Malware payload", "value": "1e1b18d9427c51a7d1f8ab8ba4a43841fe0dbaccc20016a58620acb044ba8461b1913f47a68b7e57714a806e8859a70d", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773544400, "uuid": "72d49a55-b30e-480a-84f7-e091bd2ddf78", "value": "T158B34FCE1E8E4ABD86DA7C2485DFDD03E6CAC307925EC4A07B4F95487F32DA4A0A45D1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773544400, "uuid": "c76f525f-d9a2-4f18-ad60-a4d8e502b432", "value": "768:5svIJNwiE1Et5zxyDTxltxQkjQ/A34kKkExjlvmhiP2/85Bbgh5z4AfDrdafH6b8:hoEDEDTx5oBawqdRafcw5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773544400, "uuid": "70de2234-41a0-4286-9050-77811fbcdfaa", "value": 111219, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773544400, "uuid": "0dda9fc7-0cb9-41f2-b2b7-77141d91d06d", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773544400, "uuid": "2187a59f-2260-4c16-afe7-5ee80e483994", "value": "Images_Beta_v1.8.jpg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64157f66-2037-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1773555769, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773555769, "uuid": "7275e01c-eb81-4a7d-bfa6-273fd023993c", "comment": "Malware payload (SalatStealer)", "value": "649ed975c6f61250189c3df0065d8f88", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773555769, "uuid": "e39be836-0a24-46ec-8ea9-f37bbd06b853", "comment": "Malware payload (SalatStealer)", "value": "9e4418521af9b91fce30561ce2982fd32378dc794afbcd95a2ddcb1e46e37c5a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773555769, "uuid": "8da483be-d700-4d77-bf79-e40c61916700", "comment": "Malware payload (SalatStealer)", "value": "1e7419ab42f549f2ee2b7fb8eefcf83d85dbb2cd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773555769, "uuid": "d5cbeca9-2fdb-437e-8b39-b78431dea0e1", "comment": "Malware payload (SalatStealer)", "value": "d00e13f1fd6265d38062e078e7807d97814777172c768bca5fcf8337bf68ccb8fd9574656a853e40fef2db51629f2d4d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773555769, "uuid": "561dfa90-6ac9-4ecd-afa8-962723d34841", "value": "T155D64B45FE8B95F6E903183141ABB27F23315D048B28DB97EB483A2BF8776D1197A305", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773555769, "uuid": "8288c1c0-ddb9-4641-8d99-055102370ece", "value": "49152:1vxuadmf5h6oUq/6LHHxq9H6TFvXz3Hip7V4RIGQth+dG3ZuIBtPOz8wFGJpAHnT:juSmx6Ln8l65X+p1nrrzASl4pLE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773555769, "uuid": "03e9c2a2-c94a-4621-8399-4302632e9709", "value": 12922368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773555769, "uuid": "7d70c578-400a-4618-8b61-228fbc3d8e78", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773555769, "uuid": "e714cd64-a853-45a9-a963-df738d5a5e13", "value": "9e4418521af9b91f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82309d70-20ca-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773618956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773618956, "uuid": "752e76e1-6e68-40ea-ad35-2226b7408607", "comment": "Malware payload (Mirai)", "value": "55bfedbcb3655b92615aa4c407ed4fbc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773618956, "uuid": "0c66f300-e959-41e7-b21e-2133674f58d6", "comment": "Malware payload (Mirai)", "value": "9e78ad4fdd6b1f2282459ad73c1b482ae152652558f1505c0147060819d3c9b5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773618956, "uuid": "21ae45ea-77dc-445e-9288-3da1723f9961", "comment": "Malware payload (Mirai)", "value": "1fb900a5c7a36c6257aad2c311206a9be64ee1a3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773618956, "uuid": "a1f8f8ba-e668-4346-8d56-f98d8e49d672", "comment": "Malware payload (Mirai)", "value": "faa9cfef9fb4f32590ee0ce1557fe9b72bb89555439d85e52524c2dab107e0d25e4a5c564e92c58aff5c81a6c0211b2f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773618956, "uuid": "ac07891e-4179-43e0-bd69-fb15def14e46", "value": "T19F03E159B3149FB7CCE258F950BA07801A7A07C39142FC1A639ACB9B5CA41F77C93B84", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773618956, "uuid": "a17231ad-382c-4f9d-af4d-7cd3b8fe212c", "value": "768:Ji231FZvxdHp64vbCZO/YRLNTQpYEwSakmu4dLCFWU6bLJgGlzDpbuR1JY:JhxkZVRLNcBanu4CFD6bBVJu6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773618956, "uuid": "7eb3b9ec-8458-46a4-9cd7-5bf095396418", "value": 39044, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773618956, "uuid": "edf2b9aa-79ce-4bd3-afe1-2fbc71300f82", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773618956, "uuid": "305b4436-a71a-424c-a843-afee3498bc81", "value": "pmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "491a4246-207b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773584930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773584930, "uuid": "6d19ea8e-63b6-433c-88de-36a50d9acbc3", "comment": "Malware payload", "value": "8c6e41076bffd798cf2a96afc6e1c259", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773584930, "uuid": "5182bbff-c1de-44b6-ac43-d949745758e3", "comment": "Malware payload", "value": "a078ea491822b8d8014821cdcce8bcb450947a9e1c5e0b55d259df864978ee17", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773584930, "uuid": "97357396-5244-463e-b114-493dd782a500", "comment": "Malware payload", "value": "e6abb362a5bac3a5322590e2b7836555348a397f", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773584930, "uuid": "a5ac108f-b3bb-4fa9-a5ba-77107b5c737e", "comment": "Malware payload", "value": "ad758aa96903d85c11cc42ae693f40ab017371a854dda12fc8acd7f56317c8254185581930ce874874b57716f42e8056", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773584930, "uuid": "56d0c00e-88a3-45df-9dc1-988e9cb85b26", "value": "T10E75CE0B7F952925E8A34E758937076DD2767D0026A0869B02B0F279DEF73C0593BBD2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773584930, "uuid": "403a23c1-6f2b-48f2-88ae-ec652e615992", "value": "24576:raSabiciRXdA7rD8jVssaSab0QYECTyu9U2kNf4PCql8r:JatiZdA7rYjhaIQ1pu9hKNr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773584930, "uuid": "f739db51-1d55-4e35-a008-43344f48ff9f", "value": 1622016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773584930, "uuid": "5cc7a66b-5aaa-4cf3-b0f0-2757f5e13659", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773584930, "uuid": "4f463fac-522a-49eb-b2d0-3956e387703f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b90639bb-208c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773592419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773592419, "uuid": "e0a1b5bd-3f86-4bed-8708-abded0c6d5b1", "comment": "Malware payload (Mirai)", "value": "ac15f3f75eba79e344feb2b35776557f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773592419, "uuid": "492698e2-70a6-4402-82b1-3e46728328be", "comment": "Malware payload (Mirai)", "value": "a346a36145e24157503037fa72f43c0e094bf69402132633f38c7e277348249f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773592419, "uuid": "3d56176f-a6ed-4034-9ac6-d1be1d2eec79", "comment": "Malware payload (Mirai)", "value": "be3d03d04430b25c8c4c2758c7f77bafbca0a224", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773592419, "uuid": "fc316969-14dd-4e09-a2c4-c69bb269390c", "comment": "Malware payload (Mirai)", "value": "b5cc2403020dfb4a64e6bc8ee45f0d3dcaad296d19617f05730f12fce3e8e47f97798c958b0e5b35a74882a1e84aa106", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773592419, "uuid": "9ba3dee6-5fbe-42d4-bc30-ea537732b809", "value": "T191F33B41F88788F6CD07497460ABF33FDB32D53A41368AA9EFD49E35D62B601011A39A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773592419, "uuid": "2da24e94-df33-4340-8baf-87ebd36810e3", "value": "3072:sN8g+vgOztOIsLs+JhoJ6KF444V7bXn//qxUDP/5CU:Xg+vgOztOIsLHk6uZCp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773592419, "uuid": "14bfa41b-181b-4171-a55a-27d64cd7471e", "value": 169168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773592419, "uuid": "386d7196-179d-4b73-929c-9b34917b9fd6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773592419, "uuid": "f6ef99dc-f1be-46d4-83e4-758d91ab9778", "value": "memory_load.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fd86e96-205f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773572862, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773572862, "uuid": "a87a2eaa-540a-415c-838b-6639d0bc1394", "comment": "Malware payload (Mirai)", "value": "5aca390cbdc73d701e20f5fb7e26b6c2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773572862, "uuid": "950fef1d-b841-4515-bb30-767b8d10a7bc", "comment": "Malware payload (Mirai)", "value": "a38bf57c33a57aa26b58cf645b29273caa63b736f4011763d9b0c5a5346093d8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773572862, "uuid": "50d314c8-5331-4cd3-a28d-38c35f58bb9a", "comment": "Malware payload (Mirai)", "value": "da29af4d7c80a1393780063ff008a6b41da35b70", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773572862, "uuid": "70e4c692-1c28-42ba-b540-d27886ce4769", "comment": "Malware payload (Mirai)", "value": "aa7eb49d8c86f87a2f19d5aa783910a3dd9d36ac467c21176c6a5a3439df5b70cc4142e9a960f0a70a6bfc9d986def99", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773572862, "uuid": "5d75057c-c17c-493a-9c60-084b37ef970f", "value": "T1BC24D70E7E319F7DF7AC823847B74E609258339612F1D5C5D2BCE9115E6028A242FFA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773572862, "uuid": "71afa6f0-0e8e-401f-b5bb-d1c4ba074a68", "value": "3072:waj2nhgkXpTPOw5Fivoa4+XBFRpo5fbj7I4tMM2jpZ6dGsmyO/4uHtBCoMmKSv5Y:9jzkXpTPOjRpeMM2jpZnqUNLe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773572862, "uuid": "5883c47d-5bb3-4b39-adb5-c42a6ae6a527", "value": 215124, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773572862, "uuid": "e3b40f6e-cecc-40b1-82a2-c8a8d96a7202", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773572862, "uuid": "5cb7c3b0-f8ff-4887-9e9a-1fb957f7f075", "value": "memory_load.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4b17a34-206f-11f1-a769-42010a9c0008", "comment": "Malware payload (LummaStealer)", "timestamp": 1773579930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773579930, "uuid": "ec36c1d1-d4ec-43d6-9945-044208eddb71", "comment": "Malware payload (LummaStealer)", "value": "34fcf36f2e20f641cd6d564096aeb452", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773579930, "uuid": "d081f0ae-5eac-4534-8f75-53b0d31c0415", "comment": "Malware payload (LummaStealer)", "value": "a3e6b4d11165cbc67081dfa5d516fd4f05a06c1de7e7f05450611d1987bc7bfe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773579930, "uuid": "2fffbf5a-cadb-4869-a10d-eaa49ee43a63", "comment": "Malware payload (LummaStealer)", "value": "9b7cc455f4bdf2d24ef3b70a4b91fd65d6850d13", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773579930, "uuid": "f8a94458-808d-47f4-9be2-979181e7b2ac", "comment": "Malware payload (LummaStealer)", "value": "a5743163f4a7957a04fec17dc603260ac5a8c02855f9b6d1d545783c9edd3c109290884cb79ae0308b9cdc2c29c5113e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773579930, "uuid": "b7d70fba-0e32-44bd-afb3-be73df85daa8", "value": "T133747B0AEB73A1F1CD46447421EEB73F9A382B1153388FC79F90DF8469636E25976602", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773579930, "uuid": "e7e773e2-c0b0-4060-a3fe-0988e5b25c92", "value": "751192b12ca173caf3b9646188d19603", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773579930, "uuid": "fd6301b0-b068-4b1c-8ea7-a956e5aec8b3", "value": "6144:+p2VQ100KZq7zw3PzDEuWksjpubk/uv/ksvlZjaKFOzgO6:+p0TqHwfzDw4bGOkoZczt6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773579930, "uuid": "2d7d0295-cd4f-43f3-8221-a2b64c02cc57", "value": 337920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773579930, "uuid": "fa9be02b-61b8-41c9-ab8f-2935a7350875", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773579930, "uuid": "b8adf5f3-56b4-4ecf-9ebb-c534b501846b", "value": "a3e6b4d11165cbc67081dfa5d516fd4f05a06c1de7e7f05450611d1987bc7bfe.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0ae84fd-2017-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773542154, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773542154, "uuid": "43b0d009-7374-44b4-b7f8-b4625711d6dc", "comment": "Malware payload", "value": "055119c21020acc857ca7cf325fcb5f9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false }, { "name": "vshell", "colour": "#9EC2F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773542154, "uuid": "bdcce468-4db1-419e-b507-7f524300ecab", "comment": "Malware payload", "value": "a4ed49e3cc91c3856fd927ecaabdc1b99ef8541a111239f6a9ee6a65a271f74f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false }, { "name": "vshell", "colour": "#9EC2F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773542154, "uuid": "80c8d3b8-3585-4fcc-812a-42149c348668", "comment": "Malware payload", "value": "5976616cb34a7d111100e4f5c70490bddddb0cba", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false }, { "name": "vshell", "colour": "#9EC2F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773542154, "uuid": "4b38668e-3eb2-4720-9112-7e7f28745cea", "comment": "Malware payload", "value": "c0c263c489c759229e7d522581005d5ede4fae394ce41f4742699f1d6a252582f66b7497ea07d2760b82818f9c1a8b9a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false }, { "name": "vshell", "colour": "#9EC2F3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773542154, "uuid": "d58cb2c3-5e47-47ea-ab8e-846d69eee378", "value": "T15C423A4EF69708F5DDBA8170C06F5A06E0B2B9245371B74B872090157BD2BF2742AB8C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773542154, "uuid": "c4d423e3-e1b2-49b6-85dd-a67150b1c3f1", "value": "9b06d7b8757ca6d8aa89069ed1b23eac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773542154, "uuid": "2ea96692-105e-4aca-b0d1-e385321ce662", "value": "192:03mv/yJjLEjeHJhHLyS9+3Q5tfOgS47jXKC:03m3QXSG23ojaC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773542154, "uuid": "0c7c4e49-15bd-4ec9-a2df-69d8d11ecc90", "value": 12288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773542154, "uuid": "16f5dc53-ab07-4577-8b6e-14adb91b188c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773542154, "uuid": "7dce9c09-ef40-4f30-bc85-47eb633a34ed", "value": "test10.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cad5624a-2040-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1773559807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773559807, "uuid": "8575df34-11c4-495f-9604-9477d1516189", "comment": "Malware payload (AsyncRAT)", "value": "8cfb8b15f4f91031fde148367dca716d", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773559807, "uuid": "6a64e91d-4c91-4ce1-b6de-cc8b71c2bc0b", "comment": "Malware payload (AsyncRAT)", "value": "a6d173aba832f70e476eff7b325f7216a90a72449a02cf53204819cc48836e22", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773559807, "uuid": "2a6bbf91-bd3e-4f0a-8ecf-8790842aacfd", "comment": "Malware payload (AsyncRAT)", "value": "d23bc152f27672757bc0e9de9cb94fa8e61a5d22", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773559807, "uuid": "bf0a19ad-79f7-42f2-9ccd-badf58145f08", "comment": "Malware payload (AsyncRAT)", "value": "2eb845afa362403f92feaed8d8f036fb286ab3a6bc7734a52cb71eb9eed7641e48b17d05580e1cf2789350a250a0cdc8", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773559807, "uuid": "d41c68cc-b23e-4d70-bdfb-63c6ef3e1d37", "value": "T1D6234B487BD44621E5FEABB06D72A5070332E6039D13E75E08E4979B1F6B7C08E817E6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773559807, "uuid": "c7285a27-883a-4408-977c-18f640266b34", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773559807, "uuid": "e16d0fc4-5772-4b1f-aba3-b6c6b1058bd4", "value": "768:qwDt3/U3T+8KkuR8llU1aG8ljuHFEPr9ypAOChbUzjybg:bt3rrR8PCa1kFM9y+OCd42bg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773559807, "uuid": "c2f1b4b1-5ab7-4c0a-a224-7fd6ae557c27", "value": 45568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773559807, "uuid": "71706fdb-c26c-46dc-9811-1e7e14c41921", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773559807, "uuid": "738ffe69-1ad0-4d31-94bb-4207c3f827e6", "value": "Coreldraw.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b33882de-204b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773564492, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773564492, "uuid": "c17ddbcb-f726-4d14-b4bc-95dd2d7aeaa0", "comment": "Malware payload", "value": "f07aa810c4ba6ff51f75f347e84e6f7e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LockCrypt", "colour": "#A20E1E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773564492, "uuid": "4b8a786e-94c0-446c-9e28-176fb140c781", "comment": "Malware payload", "value": "a700f9ced75c4143da6c4d1e09d6778e84ff570ea7d297fc130a0844e56c96ad", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LockCrypt", "colour": "#A20E1E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773564492, "uuid": "175002c1-480a-425d-b177-93160820b370", "comment": "Malware payload", "value": "cb1acf9a6c088060b7f24ba933be0d98bb5e68e6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LockCrypt", "colour": "#A20E1E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773564492, "uuid": "9e22bb42-eb06-4f3b-a387-9579ddbec3fa", "comment": "Malware payload", "value": "95cc3560e6ac377bc29b99483ae83e574e297fade835ffb16c0f0004b41357e8ab3246f81d37e98d809cbd7508214542", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LockCrypt", "colour": "#A20E1E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773564492, "uuid": "54d96df0-8e27-4317-ae4a-dec732ed45ca", "value": "T164425B0BA10845D3C610DBFA328B97A5C73D86B9A76D6252DFC10C102ABC1B3CF6764E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773564492, "uuid": "c7632a5e-2db5-4414-9134-fcdcc0f15fb7", "value": "0a98a06f576cfeebd2f91325d9ccac02", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773564492, "uuid": "f0093c92-fcaf-4e9b-b0d9-ed732e450ba7", "value": "192:QEsTzSIs3HIuvipDu3uTtKTzTwmH+STs8fpgiRHIYGL4vKrGoO:QE0JoapKeTtKTz8s+S48h5dIYxK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773564492, "uuid": "de9ff580-6def-4cc4-8add-db1c595c5a45", "value": 12288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773564492, "uuid": "34ced1ee-e2fe-452e-a6f2-9ea44e8ddb77", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773564492, "uuid": "0838f858-9ea2-4694-b567-2b0effe7bebe", "value": "Frederik888.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0295af45-2019-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1773542721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773542721, "uuid": "a296e7ed-57eb-46df-a795-78eb2a83e1f7", "comment": "Malware payload (ValleyRAT)", "value": "6b9aaf2a97c522d8cf95a587ac51f5b0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773542721, "uuid": "bee4ec70-d157-40db-b71d-806e09893864", "comment": "Malware payload (ValleyRAT)", "value": "a777e1f816f6554cce97f5d71dc6814c30e6806ca6337ca04fd08f9e94b65e90", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773542721, "uuid": "01f81bbe-0c42-4d2a-91a3-d684cd772c6d", "comment": "Malware payload (ValleyRAT)", "value": "16efccbe7520c6a760349f4e55b2c6a4f41395f8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773542721, "uuid": "cf2f3d61-40cb-4d8c-8e08-a05727d35afe", "comment": "Malware payload (ValleyRAT)", "value": "13e7f2d2b389c51ebfdfd49051c9b0a6d7f38a1544ed8d09229851237c11f612feb300348763b924ca7b6a632fd0fbb8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773542721, "uuid": "87793432-fb38-4e91-884b-dbda5320c028", "value": "T1C34733D2499419EBFE245E7E86D3304D8D34BB267B01623B7681DA017E2211E937FEB1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773542721, "uuid": "240abc25-4b07-40af-9f44-c24e1c1fae2f", "value": "d221b1dc8c3a08622f6512e7876527c8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773542721, "uuid": "8c7cb760-fce5-4b8f-b050-cb036b17ca48", "value": "786432:UbHnZrnpXbwy8v6yoNOJ9+EEG2Waib5Ai:unZFcy8SysObbaibCi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773542721, "uuid": "646aadb2-40c7-415d-b779-57787248ce5d", "value": 26384163, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773542721, "uuid": "77b46fbd-51d1-48db-bd93-4e4f8aebbf9b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773542721, "uuid": "c73e5ade-c96c-46ee-8967-8eb2baedad5f", "value": "Chrome333-x64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66766e3e-20ae-11f1-a769-42010a9c0008", "comment": "Malware payload (Adware.Generic)", "timestamp": 1773606884, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773606884, "uuid": "d08dc05f-e3a8-41d2-8f47-a9bc517c2245", "comment": "Malware payload (Adware.Generic)", "value": "a20588b89361f8b036d657da1fd233ad", "object_relation": "md5", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773606884, "uuid": "e41f38ca-d55f-42d8-a8c6-281ad56529b5", "comment": "Malware payload (Adware.Generic)", "value": "a8e8908051ca59f3c5e16e90e1100b764fd1aefe3d27cb0a16f6728e39efbe47", "object_relation": "sha256", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773606884, "uuid": "e2a72acf-81a6-477b-8830-b66bdb3b7712", "comment": "Malware payload (Adware.Generic)", "value": "7373f51b240642f67253f61fda7132116ec854c2", "object_relation": "sha1", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773606884, "uuid": "26dfd040-e8f6-4ab3-89f7-abf109a8da1d", "comment": "Malware payload (Adware.Generic)", "value": "8e8137665174d0dc1f1af074bac1b97531f680480239d6235c70a9696e2c015011c6cba9487df60156eb0af070df7d6e", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773606884, "uuid": "152826f5-1310-4309-9c25-d03e7ccefcd0", "value": "T1FC47333FB2A8A13EC86A0B325A73D360597BBA2175178C1F43F4491DDF769A02D3B641", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773606884, "uuid": "275876ca-f3e7-4b81-a40a-090c4a885c2b", "value": "e569e6f445d32ba23766ad67d1e3787f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773606884, "uuid": "54e6d9f5-7131-451e-aa69-a00ea504dbc6", "value": "393216:9eoQlIlTp4uGuvvku08Yvr1W1SU2ILBZXhkfSn8AtCD9wZKSjlJlCjfg0RDYx:kzqlTmEHH01M1+eRF8AtCWZnsfg0RDYx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773606884, "uuid": "9f566011-23a6-4a07-9224-7980de2cb10b", "value": 25223862, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773606884, "uuid": "27934bb0-0b79-4976-bed7-4ac61ba1c301", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773606884, "uuid": "1ce83377-ff84-4651-a4b5-e4bab7530712", "value": "a8e8908051ca59f3c5e16e90e1100b764fd1aefe3d27cb0a16f6728e39efbe47.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83517656-204e-11f1-a769-42010a9c0008", "comment": "Malware payload (MicroStealer)", "timestamp": 1773565700, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773565700, "uuid": "09700b0a-d20d-40cd-b4df-49aca76fe328", "comment": "Malware payload (MicroStealer)", "value": "332536b2b2d831b07e3d6b2fd784d744", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "MicroStealer", "colour": "#E85CC2", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773565700, "uuid": "0094474e-f582-4bab-9a70-53fadfd1a0ae", "comment": "Malware payload (MicroStealer)", "value": "a9782edad95022f6d93c31d76ab364b92423f633779ecce20fd4900d65725691", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "MicroStealer", "colour": "#E85CC2", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773565700, "uuid": "016dcf30-8090-48cf-8dcc-f2665f4f22c7", "comment": "Malware payload (MicroStealer)", "value": "3fac81e27aea0725ffaf88e2ef623ed980f8df87", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "MicroStealer", "colour": "#E85CC2", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773565700, "uuid": "a8183474-35e0-45bd-b68e-7cfb3328cf98", "comment": "Malware payload (MicroStealer)", "value": "43f435e42823f2b4d7966fde0d8866dfc223d2cca2475e2203e60420d9d8c0bb4ac0d31fee2eff9885488b31d89c51bd", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "MicroStealer", "colour": "#E85CC2", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773565700, "uuid": "c0d13e14-9da2-4082-95dc-1cbc6d409989", "value": "T107570219D15F403ACA57D67928EF4BE6FF34869F8220571F23F439198CD2B890B22B59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773565700, "uuid": "3279af77-d49c-4330-bb47-b1dd6872d314", "value": "786432:LDNcLQGN5q+feL1rC8Mk4CrpPXjstm97IDEzN:LDNccY55eLVC8MkDtPXWu7I4zN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773565700, "uuid": "ec59e598-04ea-4274-bf3e-611f726d46ed", "value": 29587845, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773565700, "uuid": "5e4f4fee-d795-4d7c-869b-75dca2348874", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773565700, "uuid": "0a68df99-4ebf-4583-90b4-211c5b8a932d", "value": "service.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a74a5b0d-205d-11f1-a769-42010a9c0008", "comment": "Malware payload (LummaStealer)", "timestamp": 1773572203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773572203, "uuid": "4b31c3db-bd39-407e-8e23-5cd79547977b", "comment": "Malware payload (LummaStealer)", "value": "f19644a7e2f8e7c384000f82998fe0b1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773572203, "uuid": "ea5888af-cd39-4891-a337-17be8ff20d5f", "comment": "Malware payload (LummaStealer)", "value": "abb0e54027d3dfd4fa0274505f0faf12083d6a94ffb95a534056a9577f9ff252", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773572203, "uuid": "24cb2786-d52c-48e9-ac2d-b899cf6cd356", "comment": "Malware payload (LummaStealer)", "value": "a6e0bdf5742eec82f4b70dcc9adcab394d45b902", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773572203, "uuid": "8fc8acde-9d8b-4b27-be14-e72938fb84bd", "comment": "Malware payload (LummaStealer)", "value": "13fdf84f943b6e9d0553e5d90f6bdde0d3412bae3ba178a0023a2c58d2e10c7217ee71f677c028a12e137b422779f80b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773572203, "uuid": "56ddccbc-1048-4ad5-8841-bd07efd68040", "value": "T161549D09E7B354E1DA8304B821DEB37F5A38561163389ED7CFC4CF847523AE29976A06", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773572203, "uuid": "5c2ff4ba-f9db-4af8-bc0c-67ec973ea7ee", "value": "f12ef0517c38c05cea3130091585ea2f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773572203, "uuid": "23f46298-e7bd-41d6-a7cf-16c4fb7a332c", "value": "3072:HZjN74Q5snem/yjosIKinw+Ed5i1v+jGaLDcCZqBtZQscnyEjSOXHt8hDU+oxK8L:HZjN7pICYw+EXcGGelqVb8zxXsDaJR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773572203, "uuid": "5ffdf6d9-0315-449c-a473-5e45463619ab", "value": 293888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773572203, "uuid": "6902f887-66e3-4b97-9fe8-be52db94eb38", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773572203, "uuid": "ad3380dd-4430-4ec7-895d-fc58cf4a528b", "value": "abb0e54027d3dfd4fa0274505f0faf12083d6a94ffb95a534056a9577f9ff252.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "271c1cb1-20b0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773607636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773607636, "uuid": "35144a2d-d3be-4536-ad58-a550a17f047c", "comment": "Malware payload", "value": "f2d58cb22203ef6659de067f4414da4d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773607636, "uuid": "fa886f4b-0a07-4ad9-be4a-bfbf5c0a81e4", "comment": "Malware payload", "value": "abf39cbf32caf190fe66e941b0d6348717cb47782ea7e3da934baf3844622e1f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773607636, "uuid": "58b717d3-b32a-4610-a703-f589efc3e695", "comment": "Malware payload", "value": "02f90681155a4454fee4c62b03e35aca0594b923", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773607636, "uuid": "709b9599-ca53-49ac-ab63-d16bb2eaffe3", "comment": "Malware payload", "value": "95b45b7476dd98c895ec49f8a826cb74ef6d45a44f835bf70c3725e4dffc034ff740df66dbf2209fe28263b2e673b231", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773607636, "uuid": "bbe2a5c4-4ce5-4fb5-aa10-05084006914a", "value": "T1AE0733C7D1C9ABA9C0838979A58342D7F0C1A49BDDBB4A183ECF0C06F861D5646C7BB5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773607636, "uuid": "1b9a6bef-facf-4771-ba79-cc54a2c01b05", "value": "70f85dde85ab3b92a87a4925eb317a73", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773607636, "uuid": "ce080cee-726c-4d6d-844b-2bc507e83f21", "value": "393216:2QFjB/kgwUEBNzZpSgeabQltIECdt+B0vQfm:2n/2geabQ8vhQu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773607636, "uuid": "eaf79019-d00c-400e-9f42-fdde5a3b1423", "value": 17059328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773607636, "uuid": "53909fef-7382-4a3b-9a18-579f2fe1bba3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773607636, "uuid": "2c8d7ee9-2067-4944-9d81-6d6d9479b042", "value": "loader.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11a3b6c9-2091-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773594286, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773594286, "uuid": "d29077da-d0bf-4a29-9d4b-c40789e1c70a", "comment": "Malware payload", "value": "1cab56a934eb1a09ee173d7dc454f49c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shellcode", "colour": "#E5D9A7", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.se[sd]", "colour": "#25B81F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773594286, "uuid": "5440d4d9-b480-4e19-b1d7-19fb97d5afa9", "comment": "Malware payload", "value": "ad892972e9788fff31f5f166da937d1229c7970d6e0c693164b2f484dd0c9aba", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shellcode", "colour": "#E5D9A7", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.se[sd]", "colour": "#25B81F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773594286, "uuid": "a670980d-d675-46cf-a89a-69196fbe4ae6", "comment": "Malware payload", "value": "8e086672aed7a0908c4941f93dd9db593e33ec0c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shellcode", "colour": "#E5D9A7", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.se[sd]", "colour": "#25B81F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773594286, "uuid": "f61dc8c5-9b73-46a3-9fa4-cf99359b5d12", "comment": "Malware payload", "value": "0781a37d1aa787f07dc43b48548a88d4a049dc87d36d0e5b201cc6ab0217604d700f2affa29be780bd5181fbcb088850", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shellcode", "colour": "#E5D9A7", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.se[sd]", "colour": "#25B81F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773594286, "uuid": "a26be4b2-2db8-4c32-b2ec-a605e5090beb", "value": "T180B633023F55DB0CF512C0BA664D5610956E37B3137C5B2BD6B2DA8A9E74C02F4AF89C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773594286, "uuid": "45d8c947-5de0-4118-b611-915949ba4726", "value": "196608:kQdVfbwrTN91cxlboaPERSk+QqH89UAbt8h8Gtl/KrBl/wlRuV:kQdVjop91az8R8UtILH/KrB5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773594286, "uuid": "3f371a8f-8760-4d66-b936-9c1c2c7bbb8c", "value": 10792960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773594286, "uuid": "0533e2ce-deb5-49d3-b310-3606f7e3606a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773594286, "uuid": "280e4289-9c46-4f3c-b3b6-c042b07efd21", "value": "10.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38cebee4-205f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773572877, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773572877, "uuid": "2c48aedd-e65e-4a8c-80b8-a2524982566a", "comment": "Malware payload (Mirai)", "value": "fd84c96fe044b2dc092572f1db65ea58", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "x86_64", "colour": "#DD69A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773572877, "uuid": "4d40a88a-9ef3-4a9e-8a30-3858537647d0", "comment": "Malware payload (Mirai)", "value": "add2bfd7477e846b561bfd448f051ab1e7fcfc5a9f31fb5fdb7d793db1c5dbaf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "x86_64", "colour": "#DD69A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773572877, "uuid": "0a71321e-cbca-4e11-8235-43f1d23a5dfd", "comment": "Malware payload (Mirai)", "value": "d52a6e91968a06fd7ec1743b9e8d7010ecedde1d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "x86_64", "colour": "#DD69A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773572877, "uuid": "9b2faabf-04bd-4c1b-94b8-f8a3a87ff054", "comment": "Malware payload (Mirai)", "value": "b76b6093a37da14ee5f8e5eca35db075d5116df24b5ec3f3a254d76788ff5c2d2e060dccbf49103c4eb548d839da823d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "x86_64", "colour": "#DD69A1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773572877, "uuid": "41d2c50a-e4ad-43f9-ae30-86519297d776", "value": "T119F34A42764040FEC48AE13816BF6A36D925B4BD0335B5AB37D0BF1B7C59EB05B2E249", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773572877, "uuid": "50da2dbc-ea4b-498e-a275-0ad33cb4ba2b", "value": "3072:VrkDTs/TIuJLhuOtm7IyxlOvk2cWKHAbyrZ9a7+ZalXVl+vLnokArDjuf5iOz:VrkDTs/TIuJL4OtZyxa/cWKHQ43uGYoZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773572877, "uuid": "47498be4-4129-4a93-9424-37e64188c7ea", "value": 161728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773572877, "uuid": "40e19f0d-5f7a-4ca6-90ce-224ee65401f5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773572877, "uuid": "e2be1c12-e8fc-437d-90a8-02ada06b8731", "value": "memory_load.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e797f14-205f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773572859, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773572859, "uuid": "3962ada3-04cf-4452-81d0-86c46c266bc0", "comment": "Malware payload (Mirai)", "value": "1d78578fb46cd52eb7ca5b6fce6e6282", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "m68k", "colour": "#3C3F0E", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773572859, "uuid": "1809c99d-8ff1-4ae9-ada2-785745d4ecc6", "comment": "Malware payload (Mirai)", "value": "ae1b8f76ad72539f470e0ab85f14cb30adf2a8c6c1b3902e05c771118a8d33d0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "m68k", "colour": "#3C3F0E", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773572859, "uuid": "34ab97d8-3688-4be6-b094-f79434151349", "comment": "Malware payload (Mirai)", "value": "c0427ce074d82e586291838179b28b35266e6e35", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "m68k", "colour": "#3C3F0E", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773572859, "uuid": "add595a1-3e69-4224-88b9-7748787a33a5", "comment": "Malware payload (Mirai)", "value": "eaed3813a3d293656a0c9bd2eca4c888c493d237ec4efa86e2bd874c2043e7e021e451f2067b9a6d6abf7dac1bc7a624", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "m68k", "colour": "#3C3F0E", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773572859, "uuid": "261fb595-79a5-40e6-82ad-ead3747b15b1", "value": "T121045C95F4019F7CF4CA95FD45270909A130925A30A70F1BF293BD9AFC351EA5A0FE8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773572859, "uuid": "40e39784-1f54-47f7-abcd-b2959cee4ec5", "value": "3072:UdH13qZ+gY2YEBKw+ig5MvwQgqn0kbCooqNb+w0xuN8dWYrNNYCqZqz7dTLo25pk:UXqZ+gY2YEBKw+ig5MvwQgqn0kbCvqMS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773572859, "uuid": "1fcc5c2e-56da-42ac-bab3-42588be49388", "value": 183980, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773572859, "uuid": "2a8e0ce0-32d5-47ce-9630-7ddf9c10ad14", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773572859, "uuid": "b20c9a58-bd2a-4382-b279-932963891a34", "value": "memory_load.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a815523f-203c-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1773558031, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773558031, "uuid": "fb0892a8-3396-47e6-b38e-c2b90c6ee518", "comment": "Malware payload (Vidar)", "value": "b060c498353e9f4b9612c017871de642", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773558031, "uuid": "6587b0b5-7511-48a8-a341-b1dbe9308587", "comment": "Malware payload (Vidar)", "value": "af441c0683f07249f0a9a6e88aff3dd58e8c7597624a2719aa553464f8aaa960", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773558031, "uuid": "2c40c5d9-d198-4822-882c-55520ddcc962", "comment": "Malware payload (Vidar)", "value": "a3ad8b6eeac533ac09969b7a314c732ec8ad0102", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773558031, "uuid": "9b8d0183-0ae1-4756-89e9-663dc6214efc", "comment": "Malware payload (Vidar)", "value": "5ad9d9385aaa9560d5be53bbbba192fbaddbc7b242bd40e3962b1dc19352c5ac88488b38abd666c174faa6e561ac6d01", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773558031, "uuid": "55ab8f23-d461-4bfe-98ff-aa04c93fdac6", "value": "T1942413ECD2B8F4CEE4F3937D77A96D45FA102860F48391EA1D2189C2E9A9481FD43719", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773558031, "uuid": "129d5200-4113-4f8f-b4f7-888ac6b14aba", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773558031, "uuid": "65c783ba-241e-4fbf-8982-9e4a80c279e1", "value": "6144:8jDKWGupNPG5d2uKwQQj9314fbEu4AT1NavHkPEd:yPGupNPw2uFcjavHF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773558031, "uuid": "d79d5764-b491-47c7-af0d-da1ab2d4dbaf", "value": 225792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773558031, "uuid": "f06275f0-1511-4f95-9188-e53cab2b3896", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773558031, "uuid": "3c7ab320-8504-4c1d-b179-078356071e58", "value": "eNLe4nm.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae92a1ca-203f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773559330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773559330, "uuid": "7b70ff90-60dd-4607-b8bf-a6932603af44", "comment": "Malware payload", "value": "16ad8f3094fb1ac3bb82ee823d35c2fe", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "Goi", "colour": "#A81DA4", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "mparivahan", "colour": "#29C0BD", "exportable": true, "hide_tag": false }, { "name": "RiskWare", "colour": "#8F06FF", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773559330, "uuid": "4afb3a74-2c01-4aa9-ae88-9c279010bd3d", "comment": "Malware payload", "value": "afaab76f446dc734de64c1d94e0dd1ae850a01c69fde12ccb98bacb98df82e9d", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "Goi", "colour": "#A81DA4", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "mparivahan", "colour": "#29C0BD", "exportable": true, "hide_tag": false }, { "name": "RiskWare", "colour": "#8F06FF", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773559330, "uuid": "20a676b4-1ce3-4553-9bf0-379d6bb94fb6", "comment": "Malware payload", "value": "5e381ff5150bbc7a1c4a5d17173c4447a5306fa5", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "Goi", "colour": "#A81DA4", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "mparivahan", "colour": "#29C0BD", "exportable": true, "hide_tag": false }, { "name": "RiskWare", "colour": "#8F06FF", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773559330, "uuid": "6a118a80-1d67-4e17-a49d-69063efa5081", "comment": "Malware payload", "value": "f497db122ab954f056c6bcf94d4b7d7512f558c8dfd86878c0b6f51ebf3a5fe42609a26afaf3e6ab21505d2df58b8c79", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "Goi", "colour": "#A81DA4", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "mparivahan", "colour": "#29C0BD", "exportable": true, "hide_tag": false }, { "name": "RiskWare", "colour": "#8F06FF", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773559330, "uuid": "1795135d-9d02-417b-be6b-1b7c196e36d2", "value": "T136F62325F7889E4EC4F3D3724C7956611468EC02CB478387E964367C24BFAF48B496EA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773559330, "uuid": "76600efc-5f18-4c8d-8ecb-1880a5bf770a", "value": "393216:qcCE+3za6l/iuCurXGii4hs5M8SOF/dt0JC0E5O4OH:DCfa6liuCubGii4TXOF/dT0oxOH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773559330, "uuid": "f99a6ec2-5b6d-4549-b769-96001c1daa68", "value": 15696939, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773559330, "uuid": "a33ebc45-6f7b-4d4a-8b98-613cddb97e20", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773559330, "uuid": "aad710dc-ac3d-45b6-8c11-74ad1948efcc", "value": "Mparivahan .apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4aec5164-207d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773585792, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773585792, "uuid": "0dc515ca-384a-4fde-bd29-d64cef84747b", "comment": "Malware payload", "value": "c7c4088175010eb99916b1e41bec0b51", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773585792, "uuid": "294f8cad-0083-4080-97f5-1d7ebcc70a9f", "comment": "Malware payload", "value": "afe152652357833d901ddbe75880e951d7ff4ce68fc7065d9c861d9531ccd94e", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773585792, "uuid": "a52eeedd-fed2-4811-9abd-cb5afb5f392b", "comment": "Malware payload", "value": "8b1456e874d312856bba1a4bfc1666a13ea25df1", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773585792, "uuid": "810b7375-8adf-45a5-94e7-f52736f9dbd8", "comment": "Malware payload", "value": "5f148789db1e2fe5afd4c36bfcaa6ff344397457dff2cd8f695177533d70e96c18f17933a117373a5ecd203f6d64559b", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773585792, "uuid": "21c5e641-9f08-4b32-97ff-cf008675c874", "value": "T190B32EC95DCAC4B4AB1FB474411E6E06EAAC9113061DC980BACEAF483F169F471BEDD0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773585792, "uuid": "22662303-fa05-4fe4-84af-4e68a749666e", "value": "1536:P6PFZu0qvdawBDC+8lj5ljtI2WcK4OUPkb63Ia0fpWzUMXv9HcH:FL0hUn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773585792, "uuid": "6e3fdf6f-5e5f-49d1-8bb2-d6c5a3b25027", "value": 114084, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773585792, "uuid": "141e6da9-aeac-4610-9517-086640b9dbe7", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773585792, "uuid": "6b48dd70-0edf-4c55-92df-5742458ad5d6", "value": "Y_Release_Berlin_8759.pdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c53925b-20a1-11f1-a769-42010a9c0008", "comment": "Malware payload (RatonRAT)", "timestamp": 1773601310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773601310, "uuid": "d764b91f-fd08-4391-8d73-74a0e1b44c1d", "comment": "Malware payload (RatonRAT)", "value": "4d767c491e5f7dc712aeedbcdbcd29d7", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773601310, "uuid": "aab5d55d-98fe-4381-80cf-f32a229cf2c6", "comment": "Malware payload (RatonRAT)", "value": "b15562c0771ce6855e2186998be98482584951039424400b2413dd2f86362820", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773601310, "uuid": "681ca486-6835-43fe-a7bf-924464a29a34", "comment": "Malware payload (RatonRAT)", "value": "feea8c7c2b0c1c151a299f4d8f582d6f14f69ac8", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773601310, "uuid": "2455ddff-cdd9-422c-98dd-9657931755e5", "comment": "Malware payload (RatonRAT)", "value": "9041a1c7440a1dc9c1fdc70430eea9a385ec21d3f58e8c6b914bfb7880438362b0656b04e82a67de9e30935bd8c2f74b", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773601310, "uuid": "085456f0-f072-4d2f-91b2-7aa4db13549c", "value": "T1D706DF44BBD4CA1BE5AF87B6B4F246120775EC15E792E70B199037B81CB37042D293AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773601310, "uuid": "da44f5dd-01dd-447a-a680-18db420c967e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773601310, "uuid": "4aa7eb96-e3b2-4ae2-a904-c5f4d29d6f7e", "value": "49152:8VUBAJWgVUlsHjkmiGWU5+5WeLGpMZ7iKPfg+DTeC:4JWgVUuHjkDGjYQeqpgmd6e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773601310, "uuid": "ab0a1d8e-a146-4264-a990-50ffcdd576d5", "value": 3692032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773601310, "uuid": "c3a160e6-df8d-4a83-9134-d17accadf108", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773601310, "uuid": "f651b7cf-12ef-4646-837d-b28352e02178", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10ec7c1c-203f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773559066, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773559066, "uuid": "0fa7c4d2-eb16-4fcc-891e-118800aebc6b", "comment": "Malware payload", "value": "c5298bec9e8edb3ddf247b1819bc44a5", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "Goi", "colour": "#A81DA4", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "mparivahan", "colour": "#29C0BD", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773559066, "uuid": "26813a6c-02ec-4e18-9d0a-80db4667c365", "comment": "Malware payload", "value": "b1a8941063751656e11bbc6ab44d348cd6795d51bfc890424595c4ac76e52013", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "Goi", "colour": "#A81DA4", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "mparivahan", "colour": "#29C0BD", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773559066, "uuid": "e642a2cc-e3dc-4023-a1ba-1a004a6ba24b", "comment": "Malware payload", "value": "7faa15d3c98c220465485096ddf2ea4f92998022", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "Goi", "colour": "#A81DA4", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "mparivahan", "colour": "#29C0BD", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773559066, "uuid": "87b43e6e-437a-4856-8416-2378e2233b05", "comment": "Malware payload", "value": "0de9cc2b6ef65398d81bbf5192261d9220b6f887f79c68980f9d2b0f59890af092b09d7ae87d5ceaefcfaff050dfcfec", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "Goi", "colour": "#A81DA4", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "mparivahan", "colour": "#29C0BD", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773559066, "uuid": "d9491c62-b165-4431-b847-af448b8aee00", "value": "T1A646F1827F4B82DAC83C56BE961F9BB5614BCC30DE814A53714A372D65BB4C60E0BF91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773559066, "uuid": "8e134186-4a48-4002-b5ab-a0e03c33a4f8", "value": "98304:IFDSFl0a+wRMpi8zdUodMP8Pyq0Ssj4tyKI1hOlW4pTyD+EovTI544:IFeFx+wRMpi8GoK8Pyq0Dj4tyX3SWWOT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773559066, "uuid": "e476d11e-b9e2-4a84-b4b4-e6096caf6401", "value": 5416035, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773559066, "uuid": "d41efba5-e982-4e55-b9ac-aee70de49186", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773559066, "uuid": "55e00347-4ca8-4291-9b36-96cf7a1092e4", "value": "mParivhaan 6.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85a32c20-2018-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773542511, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773542511, "uuid": "2d8148d5-ee8d-46d8-a7a7-83bdabcf651f", "comment": "Malware payload (Mirai)", "value": "627dd4b68131a8482fedb433be757dd9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773542511, "uuid": "f0dcfd50-9fd5-4d43-8110-a0066995d0b4", "comment": "Malware payload (Mirai)", "value": "b2a5a733664ac0b32a407a55760e8568d80c318354e1bad0d5d5719d8806d1ab", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773542511, "uuid": "8b1cbd06-c6ae-4ba3-9fb3-7d7fe8b17046", "comment": "Malware payload (Mirai)", "value": "5d6c67267a31b62263666b2cfc6e85e64ea7f0e3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773542511, "uuid": "40e2b874-144f-4dbc-8179-59ff3af9d452", "comment": "Malware payload (Mirai)", "value": "0d94bc489e48e53e9cb9f8881a878211ea11948ba2c12a84bbe15cc6e031bb26cda5d5ef6a1bcd75e7cc74cf574e23d1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773542511, "uuid": "f668b231-da40-4c45-b158-f0730a76dbf8", "value": "T162B31A52BE529F13C5C221F6B79F464837137B78D6EA7102ED247FA1274B8EA0E27601", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773542511, "uuid": "f2d261e3-68d8-4ddd-8a55-af3dd78bd8a9", "value": "3072:FYkb9cSZmO/H3bif1dYJC6lnim4V3gfG532:nb9cSZmO/XeYJC6limMQfg32", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773542511, "uuid": "3f71be77-590c-4d5f-ac71-90dcc2eb1f43", "value": 113032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773542511, "uuid": "cef2e152-f770-4416-a004-ea0f7f225670", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773542511, "uuid": "94236824-856c-4cfc-939e-46d71218ac1a", "value": "data.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8510526-2093-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773595532, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773595532, "uuid": "d2f2ae44-ca5b-46b1-a1dc-5db9d42300fb", "comment": "Malware payload", "value": "c12e238b4fbced1920e01240412fad2a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773595532, "uuid": "bd26a2b8-0b6c-4161-a318-cfa98f7bb1ec", "comment": "Malware payload", "value": "b2b73b34bacca5fecdd540114da91790c60aee7300cd427ee02170d1f471c328", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773595532, "uuid": "cccbb214-8b7a-42bb-ae70-da9e373dbe66", "comment": "Malware payload", "value": "786dd446502d865cc1935e07e5534ea56b424d68", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773595532, "uuid": "ada38a2b-2e70-4f47-8086-9eba193b85a2", "comment": "Malware payload", "value": "6106f4e43e799cee51505facacbec3fab38cd751859c7650413115823b45cee0548d197f0d64901b35ad592d518f679c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773595532, "uuid": "b4c95202-3653-4424-975c-5a28bd6b4d37", "value": "T141B628AB2AE545A8C16D833AC0A2CBC1D8FB727507F7C6D771A40769CED24C55D3EA20", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773595532, "uuid": "69867d90-4ea4-48c7-9326-fdbf155ea884", "value": "b8399aa8e7b34c992334ad63f681f404", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773595532, "uuid": "84ac53c0-c57e-4188-a83a-ddb8767310fb", "value": "49152:e3BDMNyKXcTCa1C7hoaeKEvj995SA50moXGQRdReVTVdzXtdF6UYE0kzGBJEeg/v:xZ9eRRSGg/Mln0J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773595532, "uuid": "8bcfd66c-3332-4ee4-9174-cb2c8021e76e", "value": 10619904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773595532, "uuid": "d70c37db-4f4f-427d-9e1b-b5ab6a74b1c6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773595532, "uuid": "d86d1e41-e757-431a-ad69-446608c6a863", "value": "SecuriteInfo.com.W64.Delf.ZE.gen.Eldorado.22439.24612", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e665ad92-203f-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1773559424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773559424, "uuid": "7024d286-a1b9-4885-a80b-ab33fa459557", "comment": "Malware payload (SalatStealer)", "value": "c244dd21e185ef7ad48f017268f5828f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773559424, "uuid": "54bcc319-009b-4295-8995-cbcff0e06f65", "comment": "Malware payload (SalatStealer)", "value": "b2c0bcd066ab6b0b818536988d52dbfa9f21967270a729c9e65bf08c7da814b8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773559424, "uuid": "b342c86a-dc0c-49de-9164-ad7ba6135443", "comment": "Malware payload (SalatStealer)", "value": "bf27d7d7baa317fe6cefc1610bc08707470b076d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773559424, "uuid": "610ecc05-65be-4949-b054-ae0d2b9e8540", "comment": "Malware payload (SalatStealer)", "value": "51261028c158c560642f123ccb85250b6c81dafcc417df9c6a2c0bdf7a9736cc4d0db30b04e0a03ae0d92d6c4e62a051", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773559424, "uuid": "df42ff64-91bb-4b38-a14f-833af604ee13", "value": "T140C66B51FA8B58F5E903183140ABB23F23319D04DB78DBDBEB547A2AFC776911876248", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773559424, "uuid": "e9af9683-ca1c-47c7-95eb-5f9f966fe4ba", "value": "49152:pVpY8n9GsReN4H4CSvIHwdz96lYVaTF6tMGImNDXFfNi1HMDhEaYXSAXzznwoCQG:Xu8n904EAMDXO1setrzikn+RQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773559424, "uuid": "95bc34df-d80b-478d-a7a5-9838ea8ff258", "value": 12107264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773559424, "uuid": "466dffe9-35ba-454c-89ce-00f29de42d2f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773559424, "uuid": "de1ef541-095d-4223-8510-731c45034ad2", "value": "b2c0bcd0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9edd416-2044-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773561577, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773561577, "uuid": "59846326-f3d1-4aa6-a958-1f8ead784a72", "comment": "Malware payload", "value": "0281dcc43298c6a1d0611dca48a78396", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lmir", "colour": "#0279A5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773561577, "uuid": "21e30167-7abf-47f8-8c1e-d4196fb8b679", "comment": "Malware payload", "value": "b48cdd1f5dd5f81be8d229acad73b5fbca841218909a5b63f8473a50c6e4ec82", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lmir", "colour": "#0279A5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773561577, "uuid": "930fa2ca-ffdc-464a-ac8d-1ea647d9e163", "comment": "Malware payload", "value": "6a265a3600dc27fa58c6e2c1009eed8b7569258a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lmir", "colour": "#0279A5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773561577, "uuid": "b43a8193-e206-458f-82bb-5eee143a6a6a", "comment": "Malware payload", "value": "0e3e8660390b613b52e821ef65fdc7c45d7bab0cfbd10441e8bf5b4bd7861b940da6bd0775b3956c8e3613fc1dd8d759", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lmir", "colour": "#0279A5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773561577, "uuid": "f60162f2-09eb-42ed-87fc-f6afb3c651f4", "value": "T1CAC5E022FF81C77AD0322A7A4C17DF99953ABD601D34A95737E83F0D4EB92843A19193", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773561577, "uuid": "79f375d4-8242-4d6e-ba44-88a850f7bb27", "value": "008f2a0e41fc6d093ddb4070904d23b2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773561577, "uuid": "ed7a1a98-a5d0-41fd-936a-3bf274c74329", "value": "24576:+A8vyrepIND/0bfSPdaYrRFo9UR+h+8fEvdDrGnrdEROGHOhDxQnQxlpNC/hRJH8:+A81IJPjEnEvdDqnroHO9ynQxUHO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773561577, "uuid": "4ca3c600-5878-47f1-98f4-f8b1f62ac0c3", "value": 2692608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773561577, "uuid": "268eaab7-a7d9-40a6-8a3c-03f0962ab97d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773561577, "uuid": "c965631e-1b2c-4cc4-af50-928b9c5d55dd", "value": "LoginTools.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c02851c-20b2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773608691, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773608691, "uuid": "e2298c61-f589-4472-b589-065e0af01fec", "comment": "Malware payload", "value": "5df8e0c11ff7fa79ad4eca000a245ee6", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773608691, "uuid": "95faf1d3-6131-4704-92ed-65628e71c15e", "comment": "Malware payload", "value": "b7acc17275cf73d27f9d2ee2690b515b2d31e917b44791fef23900810a94ce3b", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773608691, "uuid": "095637ac-6353-4c49-a215-f273fd5d5692", "comment": "Malware payload", "value": "9e5dc3dd868869dec5d05a8dad46e18e5aac8f7f", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773608691, "uuid": "a4d5eae1-292e-4a15-8ed6-f17772181102", "comment": "Malware payload", "value": "5e619f7b4f66963838140f7392da0942998285a286c8100e2dafb9b6e8cd85c5e50bccca2b9acdc944a36d5cbe51abf0", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773608691, "uuid": "a48cfe7e-1d30-448b-b3f2-eb8d93b24713", "value": "T1D7A6E4AF22E495EBC15DBDFAC0938E4187F361750B3781F7C2940FA88A125D09D7A96C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773608691, "uuid": "59e97945-5827-4e18-8342-7f194cc01cce", "value": "b8399aa8e7b34c992334ad63f681f404", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773608691, "uuid": "3785a948-77bd-4e2f-b760-b3c02ba8d5a9", "value": "49152:I3BDMNyKXcTCa1C7hoaeKEvj995SA50moXGQRdReVTV/zXtdF6UYR1DCSoxqbZp:fZ9e7RSJkGZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773608691, "uuid": "2baffc18-12b6-41af-a235-6c37a390561b", "value": 10199040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773608691, "uuid": "52d5efbc-5666-490a-8d77-fa27ba268370", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773608691, "uuid": "1755a675-c8c4-45ca-badc-ab7361a213cf", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d67cdf73-2071-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1773580872, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773580872, "uuid": "cfb32e5d-4216-483e-9b39-25cbe3677d3d", "comment": "Malware payload (AgentTesla)", "value": "807723730ae1f37f11050bf5de28fab0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773580872, "uuid": "b35d98d3-5137-469b-8303-f1580f5fbc87", "comment": "Malware payload (AgentTesla)", "value": "bae9ebf2286071c5bc562644c8b056767705ee528e9fd52145db6adeec96c33a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773580872, "uuid": "5ef76c68-39b6-4aa4-b105-725266444a40", "comment": "Malware payload (AgentTesla)", "value": "0e1814f67c21b44e3e619d615fd8f3c2b281757e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773580872, "uuid": "9c690291-5ab7-4898-a720-fa166298f601", "comment": "Malware payload (AgentTesla)", "value": "a547ead5783ffb534cd33b1bd7465a444866b803aed2b26f93364b01764ffd40421156f84f12700de6fb35a73000d852", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773580872, "uuid": "d2467bda-eba2-4eb4-a63d-d056f7f33c9f", "value": "T1F735F1082767EC07C1B65BF148F1D27447F95E489422C3139FF6ADEB7A26B896984383", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773580872, "uuid": "30391523-a522-4a20-baac-82cc861c0952", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773580872, "uuid": "9e3afbf3-9e55-4999-a967-600fad7870e4", "value": "24576:F9fZLD1pciaZlhshnRd7oTBdLpAOKNgYvp2kAD739rnvVBx7MO7gQ:F9fZPHcT8RloTrpAvCYxA97vJX7gQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773580872, "uuid": "65c83000-7edb-490c-bb9a-c239480c53a1", "value": 1094144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773580872, "uuid": "bd7a2842-5cfb-4cff-9a78-866c78ac7f4f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773580872, "uuid": "e2bfb589-7b03-44bf-aa28-3ba77107d3bf", "value": "Payment_Advice.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48f54505-20ca-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773618860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773618860, "uuid": "f2efe2ca-fd4b-479d-b64e-6247a2e9e6d7", "comment": "Malware payload (Mirai)", "value": "e2639147da68d1bb097e59706531f0ab", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773618860, "uuid": "d89e9d13-cc82-4188-8621-9cef0e1ba832", "comment": "Malware payload (Mirai)", "value": "be83bec3b82bf2eb08c9926a1e8d31dc4ba2a7e0d5e08de7700a9ec300b78ae3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773618860, "uuid": "dd38e3f0-749d-43b5-929e-91c53f85062e", "comment": "Malware payload (Mirai)", "value": "10ccbddc267d57fe8153f28a761fe3982731d952", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773618860, "uuid": "a324ab69-4d3f-4b78-bdd6-a99c07fcda0d", "comment": "Malware payload (Mirai)", "value": "2a81e71cf41a1f9d47202f5d02c5f75b94fb2fdc8c92d78f4d20d8d76341230cccee726884cd69696d38b649434a205b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773618860, "uuid": "049e917c-b152-48de-96bf-beeb001227a2", "value": "T1F9A30709AB650FF7DC6FCD3706E9070635CC651A22F97B3A3634C918B60B64B5AE3864", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773618860, "uuid": "e8ed3b35-b898-4bb0-946e-db059747fab2", "value": "1536:uJri55uEJPlFDJBCALbF88QUW/M1ms56XGZDQ+wbp4lx9LJxXY61d6cM:A+3uEJ9HbxW/w6XGkmRxX1l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773618860, "uuid": "56c2a3b5-fdcf-48f5-9045-71bcf47ee9a2", "value": 99560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773618860, "uuid": "dfef4f92-78a3-4ea9-8c02-9d6c3207518e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773618860, "uuid": "c5823050-fc0c-4a92-8f9f-f705b32ab21f", "value": "pmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "399004dc-2051-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1773566865, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773566865, "uuid": "d2bf4932-d192-48e7-ada3-244dc1817e61", "comment": "Malware payload (Vidar)", "value": "25ae6615cd68bf809f7d6c626ad05aaf", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773566865, "uuid": "5fb981bd-e3d6-493f-9d2e-edfbb971a06d", "comment": "Malware payload (Vidar)", "value": "bf5ccf93b7eb70d6f102cf7bc626b97c600089dfddcb9c8964ea40565793b82f", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773566865, "uuid": "9a97704e-4079-45e0-8fc8-5e28a12255d8", "comment": "Malware payload (Vidar)", "value": "02cb8b823c6e43de9b0973c5ee1471806a0a396d", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773566865, "uuid": "9d9b8505-e9b4-42e3-ab40-e0c7009a94b3", "comment": "Malware payload (Vidar)", "value": "79288fe4a6da598dc5ad06897269dd86587605ec7d6f4765824a0c909c72d04ebbc42d3cd69211bb406e3d84e9454e64", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773566865, "uuid": "857a4013-b830-460e-b2a9-2d0c2da40d45", "value": "T18A663ABB666D87A8F1EEC13EC0528F0895F770740733C6E7229117686AC65D85E3EB24", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773566865, "uuid": "9c70a9dd-9ae4-4eec-bc88-95dbc3a69c4c", "value": "20aad64209ad1c0f921334c68abd4a57", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773566865, "uuid": "f508ca13-0df7-41a1-b202-3c9691902a50", "value": "49152:tdhZ2Glv68IJXFK2E4zmm9aSQQOFtxTFYS22tbg4AqJfK/KiW:CN2tbgyJq/W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773566865, "uuid": "a7db3be1-7234-47ec-a652-028bb3c97036", "value": 6619136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773566865, "uuid": "948973f2-fda7-48ba-9d4b-bd273b75096c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773566865, "uuid": "974ff41d-8865-4cdb-8f0d-acf1c045d981", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62e23c8b-2050-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773566505, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773566505, "uuid": "d75aeb87-9616-4c1d-a164-5675e4735ebf", "comment": "Malware payload (Mirai)", "value": "0442fc4568cef0f970300e24e871b601", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773566505, "uuid": "414f9961-543f-41b2-9ff1-a5ec1d43b73c", "comment": "Malware payload (Mirai)", "value": "c12f337e79aec5b72849b9b1a707f28e745545a1a14b598d34abe637a180b967", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773566505, "uuid": "3a2be45b-b585-44ac-90bb-e10e836c6907", "comment": "Malware payload (Mirai)", "value": "2008ba3564389e8f6e796c18fde92d248dbb42ab", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773566505, "uuid": "8f296b16-7d5d-49ee-83b8-151c67da8efd", "comment": "Malware payload (Mirai)", "value": "50a3c863ff6f6227e78ea5358fda8a1d6aee1a3dc7ad3ec18d9fec88f63e52f461ebfe6e2bb314c09891a2bf22958832", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773566505, "uuid": "19cb9652-6002-401d-abcd-f021eda6af1b", "value": "T1E121D0DE7169742DAC119F857096CD50A210F3D75C9BDF85AC5C4D21F48B6B8703AF48", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773566505, "uuid": "7d5c38bc-42ef-4de9-ada5-9486d4831078", "value": "24:Kru8nuNIyoKkMikAGtHU9HSwHIbHEuerc/Z+Fk3U:Kru8nOoeXHU9HSwHIbHE3cge3U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773566505, "uuid": "f6369929-6a43-4d2b-81c6-cac3fca0acb5", "value": 1136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773566505, "uuid": "5d9c23be-496d-461c-8515-668e06d1cc8a", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773566505, "uuid": "d8aee7e0-0a06-4fe1-a208-9815002f3cb4", "value": "w.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe23b05d-2021-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773546579, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773546579, "uuid": "87051816-b3b3-4ba6-a4eb-02af53e4b8fe", "comment": "Malware payload (Mirai)", "value": "874cb365cdf456596ad73bdc42c9cde7", "object_relation": "md5", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773546579, "uuid": "3544cc4f-88b8-4fa4-b78f-a3f34c544588", "comment": "Malware payload (Mirai)", "value": "c3b91aa16dbe60c55799392b2ab1d739692203672fb4f2f14ff1b3e2d0558bfe", "object_relation": "sha256", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773546579, "uuid": "0360f99d-43b1-445a-b470-9ef837b2d34a", "comment": "Malware payload (Mirai)", "value": "22ed48a4d2ea224c56c0dcd44f08765d675a3ad0", "object_relation": "sha1", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773546579, "uuid": "1dab9d2a-e9d1-4fa7-80d7-abc992c017b7", "comment": "Malware payload (Mirai)", "value": "afe4a5d298822a8acf28d75ba2787d76190d9825b36c07c5264164b30d2c2cbab8c55a2fc6efb48cc1c80ec0b8a266db", "object_relation": "sha3-384", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773546579, "uuid": "fa341839-0301-4ca7-b92d-9ab06f3ff303", "value": "T1BBB33A02B71D0F43D1632CF02B7B1BE1879ABE9119F8F584A11EBEC552749F62186EC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773546579, "uuid": "fe8d73b8-d2b3-4af6-88e3-9787bb7fd1be", "value": "1536:PZFFDqM/e1RiswumOXFOS+cU7HL9Ko1IckGUEZNsD0KToOC6BpcSydopfBPOe:PPF2FUwIr9xkD9D00oyUJe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773546579, "uuid": "cc7883bf-da7f-44f6-a234-bcf3d046791c", "value": 117228, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773546579, "uuid": "75b969a4-3db3-4247-9992-d7498a4d5e9a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773546579, "uuid": "3e38635f-a48f-4fb8-a74f-2f3cafd2bb04", "value": "data.powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be966986-208c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773592429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773592429, "uuid": "f8c99e33-c68a-4a03-95de-9c7eb819fdd3", "comment": "Malware payload (Mirai)", "value": "bc56addb789edc6a0c01b375abe9e5a7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773592429, "uuid": "f475a911-969b-4678-a9a3-c52760af0847", "comment": "Malware payload (Mirai)", "value": "c413638dd2defa038030cf4e607bba5a0a33f4f16df274d96a6c799f82e28cb5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773592429, "uuid": "e601539a-cb1c-4a6b-905b-7eeeb2d17a87", "comment": "Malware payload (Mirai)", "value": "1621a675ed84e2cd0719e62140a306370597ec94", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773592429, "uuid": "4d3b775a-b474-42f9-9105-53a2390ed1a4", "comment": "Malware payload (Mirai)", "value": "8dd0de9bd504286133468234240c176409841d0a10e162a009f496f6a7a1532931eef15660393b86541fd0fc91c158c4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773592429, "uuid": "b2648522-df82-4a6d-bfe6-461027a49fe8", "value": "T123E34B539687F5F0CA420AF8307BAF3295326C371235DFA6EBA4BD62AD5420190177BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773592429, "uuid": "1fe0da19-7cbe-47f1-b27a-cfd7ca4055e5", "value": "3072:365e0fnPW/DQrhRFTKWJeMAMfXJ2VcyRl3QYtKtFXKGqBDl/5C5:SvPeMfXJ45ExFaa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773592429, "uuid": "3e83384e-888a-4994-97c6-3bf335924bec", "value": 152300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773592429, "uuid": "4804c20b-dfb7-4acc-9d95-c3f36e9c489f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773592429, "uuid": "ca209384-b514-4ec0-b211-9bbd22da1062", "value": "memory_load.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83cdc713-20ca-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773618959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773618959, "uuid": "e76a6b34-7fa3-4f31-8100-666820dabb48", "comment": "Malware payload (Mirai)", "value": "2680ac9efb978c6bd3a33db1c8a435f2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773618959, "uuid": "a5dc9dcd-a8af-4bde-be86-ea32ce1f03da", "comment": "Malware payload (Mirai)", "value": "c5a82588f803980398fd4419c0d4370ba74ae3a9de068baef5b5f413fa4a7546", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773618959, "uuid": "57193b8d-9835-4056-84c7-8972fd5fe8a5", "comment": "Malware payload (Mirai)", "value": "6457fd726cb45ae6245cb1e6c4b50b3f4e0cb892", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773618959, "uuid": "0fa54aeb-ad8a-4958-b94a-9fe50925e4d7", "comment": "Malware payload (Mirai)", "value": "ea59334592efa0ba08b5d14f6d81a2e3b66a1354cf2e5a237ef5de92cc1d7df425fccb9dba804d77302c9fffa2b4882b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773618959, "uuid": "2c61e632-40fc-4452-a9e8-99d7fe004a67", "value": "T157639EB3C9393E94D25541B4B830CA795B53B48481871FFA5A98C6FA4047EBCFA093F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773618959, "uuid": "18f8f949-a43c-4f59-b2b3-7cab125fe0de", "value": "1536:sa9wtr82FLQgB97HK9QATGRuzuCy2KNdwq61d6o:sib25QgD7q9sRuzu44q7R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773618959, "uuid": "08edb647-8605-4e6d-9fff-d8891ce6dc9c", "value": 69116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773618959, "uuid": "75240ff2-52d6-4cfd-bdb3-2c1d0924b380", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773618959, "uuid": "a1c0673d-1ed0-4aeb-ace4-5f7b8bc811fd", "value": "psh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2eb76c7-2038-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773556331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773556331, "uuid": "175a6e52-5040-45bf-938e-4ffe5182d81c", "comment": "Malware payload", "value": "28417b0fb7dc5bbc96c16619db6023a4", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "Money Transfer", "colour": "#169BD4", "exportable": true, "hide_tag": false }, { "name": "Nala", "colour": "#C531DB", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773556331, "uuid": "49acbfd8-581f-4873-bf97-af3f54ec144d", "comment": "Malware payload", "value": "c794a6c7506b9f5b40b25fc108267a5b90e300cba69d175d40829615815f43a8", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "Money Transfer", "colour": "#169BD4", "exportable": true, "hide_tag": false }, { "name": "Nala", "colour": "#C531DB", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773556331, "uuid": "8259fece-5272-428f-9fad-23f396766a13", "comment": "Malware payload", "value": "de205eb75eb060290d4b5b08622dcd1432221262", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "Money Transfer", "colour": "#169BD4", "exportable": true, "hide_tag": false }, { "name": "Nala", "colour": "#C531DB", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773556331, "uuid": "bf63fc51-ce36-4f9e-be7f-068813b0d405", "comment": "Malware payload", "value": "9f3aac664819edc5f4e7fecfc0922beeabb550b1c648c79f74f5fa87f657e42ca6e4f76cc80f7b27e662370e8f378249", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "Money Transfer", "colour": "#169BD4", "exportable": true, "hide_tag": false }, { "name": "Nala", "colour": "#C531DB", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773556331, "uuid": "862e468a-1ae9-48ed-92d9-b20597819c79", "value": "T15FE61273F3685D2FD8BB00710CAAB122925A5E11CE53E34B690877AC7A779D41F89BC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773556331, "uuid": "3ddefba4-9c8b-4521-afab-55f1d67534e3", "value": "393216:QhebGzYkiyVmx4pWUarIxsFCa4S+RQEGZUv:jbGcNORaEFZS6QEGOv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773556331, "uuid": "529f27a0-882e-43f2-aba2-d73ac5d1d4cb", "value": 15210144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773556331, "uuid": "8dd9d265-663c-4176-93ba-9c59eb0ee91c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773556331, "uuid": "d45a5428-589c-4452-87e5-739789b5e8e7", "value": "nala.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "919af614-20ca-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773618982, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773618982, "uuid": "6dff9a3d-ae92-4026-86a6-00d5f29aa622", "comment": "Malware payload (Mirai)", "value": "5d97d2b802d1f26b92759bbd72fa3993", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773618982, "uuid": "fc66c272-a163-4ba9-bb15-876f90644aa6", "comment": "Malware payload (Mirai)", "value": "c8192cae2f6f67aa4ee7a029b1735545d4f2fdc33cc8ca3e804577747f0a09ba", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773618982, "uuid": "bd0c06da-b36a-42d0-b956-813a4dbf40c8", "comment": "Malware payload (Mirai)", "value": "3b0235b949b03a2d556d902aa92935d32db6cf71", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773618982, "uuid": "e38bedb2-5fe1-4e2c-8b11-0a219cbffe4f", "comment": "Malware payload (Mirai)", "value": "164c09d42b8b8f552851cde0f67e4f1044c1f7c72e75783b2e743fd4d12bf3913c41229468470215181d9af523c1c32d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773618982, "uuid": "c26edbca-3941-4657-9589-d5d3ce0ea1fc", "value": "T177F33B46F6408A13C0D6177AB6EF42453323AB6493DB73059928AFF43F8779E0E67606", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773618982, "uuid": "415f1991-37da-4cc5-9025-285dd2aba753", "value": "3072:SbzuIs9vKpSaKJS4BHqmUoq1+7pTyVINSLZJiM/9b5J:SbzuSSaKJS4BHqbob7ZyCSLZQM/9lJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773618982, "uuid": "38287f5f-baa6-4d0f-83e6-fc34a4b6c4a7", "value": 160442, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773618982, "uuid": "899df2e4-5783-495d-990b-80df374747a6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773618982, "uuid": "cf4ff006-1a17-41c2-9863-c4f13cb6261b", "value": "parm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76b9deb2-2044-11f1-a769-42010a9c0008", "comment": "Malware payload (DCRat)", "timestamp": 1773561384, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773561384, "uuid": "a18cf57a-f98f-4656-8748-0e07f86bb34a", "comment": "Malware payload (DCRat)", "value": "224387e31c1c354f96a709f6dc815cdb", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773561384, "uuid": "edd89994-d8dc-43d5-9c02-ee4cdc48df29", "comment": "Malware payload (DCRat)", "value": "c843556435a038a69bd838a61b1c757655875bf56cbec8aebb419308f4d826c1", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773561384, "uuid": "0244d1e4-5112-4cb0-baff-003d938265de", "comment": "Malware payload (DCRat)", "value": "9eeb3fb14ccbd6ef8d2c6f1d6a4f94b5f7c41b78", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773561384, "uuid": "835ba82e-a759-4f25-ba88-c82839bcf9e8", "comment": "Malware payload (DCRat)", "value": "84bc1535d9b3157e526c302c159e28156bb85d2ffef352e8ad72731443cc766786008971aa470b6176d834f33e389dcc", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773561384, "uuid": "547ac687-0d3a-41f4-b0ca-0c02be4c414b", "value": "T1FCA5337470D1C1B2E5A6103584CACB32A636B062877EC1CB7A9D77F56F603F1623A6C6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773561384, "uuid": "c747eee1-8c01-45ac-a2c8-8cae238772bb", "value": "bf5a4aa99e5b160f8521cadd6bfe73b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773561384, "uuid": "2abcacc1-ed35-4980-84bb-6953c45c964b", "value": "49152:ikQTAZYS/v6h3+1uhZcT2NnvOyLXXjFpNXCym/hXmL9W6EppQpY:iaZ5CbhZcT2lvnDFpFW/twU7+Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773561384, "uuid": "e6da4bd1-b26d-4c18-8ce1-11ea952e9277", "value": 2078720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773561384, "uuid": "122ea1e8-ec83-43e0-8496-36817ab4d937", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773561384, "uuid": "192a79ff-6a0e-427b-883d-87b74e74db79", "value": "c843556435a038a6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de05adca-2054-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1773568429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773568429, "uuid": "e8ad0c7f-de8c-442c-bba1-16df1ede3fb5", "comment": "Malware payload (Vidar)", "value": "3cb5b0894ce05a7bbe687974dc79cfc6", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773568429, "uuid": "217ff413-c2c8-436b-a0b6-0d7fbf7b276b", "comment": "Malware payload (Vidar)", "value": "c881742468198f8be593f3d6b320052d7ba009326a4ba175610ee358e9905238", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773568429, "uuid": "3bdb4b41-a6df-43ba-b4c4-4440f1533c46", "comment": "Malware payload (Vidar)", "value": "bab61c9520e87ad2378068328b1e650e7e3959f0", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773568429, "uuid": "e74fb82a-034b-482d-af17-cceee8496539", "comment": "Malware payload (Vidar)", "value": "bd37cab22e563b0148e4c93c71fb994ed88cfd1f6121682872ca4a76c6ff72ef38e6d20e773811f5c0513c09e3695f91", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773568429, "uuid": "77cd449b-78a3-4496-a73a-024e46dd167d", "value": "T1A166F56B269C4568C149813EC06F8B10B9F378F50B73CBDB53A95358BE469E07E3E264", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773568429, "uuid": "6a43597b-671a-47f6-9f48-a84ca0e6c596", "value": "20aad64209ad1c0f921334c68abd4a57", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773568429, "uuid": "f42353d2-3fef-4cc6-b7ab-236e486b8e0c", "value": "49152:sdhZ2Glv68IJXFK2E4zmm9aSQQOFthTFYS22t+HTsa4:DV2t+HIF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773568429, "uuid": "5d1d93bc-c3f2-41fc-acf1-6b2e7d3dee8f", "value": 6737920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773568429, "uuid": "36b6e3de-699e-4ed3-bdd9-0c1e516dbf70", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773568429, "uuid": "042bb8cd-ae3a-4149-9d05-daefed68723e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbab38e7-206c-11f1-a769-42010a9c0008", "comment": "Malware payload (LummaStealer)", "timestamp": 1773578733, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773578733, "uuid": "bca59b99-defc-4e00-a2df-9881c770c7ad", "comment": "Malware payload (LummaStealer)", "value": "17857e3f26358d0487d847a65c5bf8ed", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773578733, "uuid": "e25ed219-aee1-4ae0-b23e-fd93968d411e", "comment": "Malware payload (LummaStealer)", "value": "ca33db27997f803adc5467f16eae97687ab8084ae5292d417ff1a0eed25c6a94", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773578733, "uuid": "1d75d46a-7a67-4537-a699-c3e3cc22f3eb", "comment": "Malware payload (LummaStealer)", "value": "fddd2ffc986f902e4e30fec4997bf9b9a8970a4c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773578733, "uuid": "35bc18ca-8ce5-4061-9c5f-94f0a589c59f", "comment": "Malware payload (LummaStealer)", "value": "1fc8b93a18470a2432e2ddd3b2de8e7f548101d7fecdc4542f16e9a9cfe1b85049f83acacad95afb76afc247f46d798b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773578733, "uuid": "e0e89bcf-5274-4c80-bcba-7d3b606aaee4", "value": "T118648D46DB1350E1D68B45B8B2CEB37F9D39432257295EC7CB84CED528279E2D83A603", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773578733, "uuid": "59a7ba63-2c02-4b6f-917f-b35af4875858", "value": "efd5a1321fb3549606827ae52de6c65d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773578733, "uuid": "3b713ae3-1f8f-48fd-9048-e3a3fb6042ae", "value": "6144:mdgHTUN//poYcVHeN7eZu8SY9XwYoxHUBbE5GqjsU:ggHTUNpkV+pEugox0BbWG8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773578733, "uuid": "12ed4f76-c15a-4559-9779-8cc7881db183", "value": 329216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773578733, "uuid": "97105288-fada-4b18-86aa-70be66ee78f0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773578733, "uuid": "0fcda361-7dc6-4961-921d-0825c5feb744", "value": "ca33db27997f803adc5467f16eae97687ab8084ae5292d417ff1a0eed25c6a94.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afd9c344-203d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773558474, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773558474, "uuid": "08cc2d79-9e86-496a-b312-548e7110f8d4", "comment": "Malware payload", "value": "3cb5719f26cba95677c37d3d45c8c7dc", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Goi", "colour": "#A81DA4", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "mparivahan", "colour": "#29C0BD", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773558474, "uuid": "87a59926-8cbb-4062-94a9-c4196e8a5410", "comment": "Malware payload", "value": "ca6271b212c627dd6e4372827a0fb316023fa35210cab7249d634379af6d649c", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Goi", "colour": "#A81DA4", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "mparivahan", "colour": "#29C0BD", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773558474, "uuid": "609c6165-6253-49fb-a586-45c70ceaccb8", "comment": "Malware payload", "value": "d142d37139c47fd02106b2af678928a3a5bfec48", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Goi", "colour": "#A81DA4", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "mparivahan", "colour": "#29C0BD", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773558474, "uuid": "443e8335-9076-4256-ab92-468ac262ba58", "comment": "Malware payload", "value": "e73fc9f04367bdcaaad17fdd5a609412fdc14d3816ca20a036f24091334d312a8f30f7dea35def7807bae819de8b9aec", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Goi", "colour": "#A81DA4", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "mparivahan", "colour": "#29C0BD", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773558474, "uuid": "46c85c3e-2f9d-4967-904e-d790d0270676", "value": "T19346E0C6AA0990BAC87E003755687E2E37D18C767DD9AA37E069B31877373D41E58F80", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773558474, "uuid": "03ad9ec3-a150-45ee-b09d-1fda16498fb6", "value": "98304:uUFJ5BiCdN9yvzqen1clMRviw/+uJl5vTI54O:uUFJ7iCByrclMRviW+uf5Ol", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773558474, "uuid": "1ad30b82-be7f-45de-b5cd-39fc8773a733", "value": 5456951, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773558474, "uuid": "96e9539b-ad67-4e45-a031-90f8cec75a33", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773558474, "uuid": "d6ebd70a-73f8-4a47-9b2f-aa07fb9c1fad", "value": "mParivahaan 13.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9fa4243-203b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773557685, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773557685, "uuid": "185eafc3-aa5f-4ca9-826a-f866018c3e82", "comment": "Malware payload", "value": "12bc1ab4e1831cc3e7428f95a3dab093", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773557685, "uuid": "0d5f5b00-1033-4f33-be82-91184296139c", "comment": "Malware payload", "value": "cbbd13986ddd2c3703e666e027a0c7dfb310d54299a6527212e836393e1bcd07", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773557685, "uuid": "95ee2e60-c01f-4aae-a70f-b30bac70ba2f", "comment": "Malware payload", "value": "b75b6d51746f715eaed3a2b17fd2959393b3f558", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773557685, "uuid": "1c259ce0-0b8e-41d9-be04-e2ee7ad82336", "comment": "Malware payload", "value": "3e7b72dd6a869bbaa4469c9bddd10a0afa50c9a9f17d0449b53db0197949a1b1c7148e2a1b623191e18806625067e91b", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773557685, "uuid": "e1ccb83d-b47a-4c34-954a-8e2560a43273", "value": "T10EB30188998A94E19F1F7064851F6F47EF9D9312413CCA80BBCEAF453F528B172B99D0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773557685, "uuid": "890ff80e-b26e-455f-abf4-2fd214b5e94f", "value": "1536:DJ3rpafqBCVj+xBXfbKHZe6+e6w0f6es+CrR/Xk4M:0cG+xBvbD6vRfE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773557685, "uuid": "b18f624f-c0f8-46e9-a0b9-932367e233ce", "value": 117300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773557685, "uuid": "e30c9e63-2d91-4f62-926f-645e12914839", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773557685, "uuid": "8f7e885c-5996-44a1-9e44-ee1f96557d31", "value": "Data_Germany__13.ini", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "224ed813-203c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773557807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773557807, "uuid": "151afcc8-9237-4eb8-a410-41a22854d9b5", "comment": "Malware payload", "value": "176e2d037b89256afe12d3f4eb5eca9f", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773557807, "uuid": "cd39b886-bb53-4346-825c-b93252fb958f", "comment": "Malware payload", "value": "cf9cb28e28e05d85b56e7bf4ecabdea24daecfbfc52584e8f50d6558c6402ba4", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773557807, "uuid": "f7976c9d-e83a-447c-905f-32b39be83fbd", "comment": "Malware payload", "value": "72c8c8c8cef70a90f779fdc5da9d7dd5f42f25f8", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773557807, "uuid": "05848031-4887-4668-936a-d14160a5d42b", "comment": "Malware payload", "value": "bbdbcbbed33285da31ec4e5fbb1de86167bb18fb287bde5859dcceab7b40d5aad49d5a79dd89d2a65948f6b47044f35e", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773557807, "uuid": "143aec00-52ac-4970-b759-8ca2eebf9840", "value": "T13DB34289199F80EF876B2495C62B9C4BDFED814F061DCA90765CEE883F43958B0A17D3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773557807, "uuid": "32cc6dbd-bcc4-4e73-857c-d4604c2c5e0e", "value": "768:owhMgc7YkzIVxHHKcjr/3w9UVoVvsEyXPfPHrwkH5O1gLNQz21DEpbaPtLNgo9eq:8pcjTyVvsEyXsmsRzIYpbaPjkEgXk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773557807, "uuid": "0161bc73-e761-490c-9842-dc10560e30ec", "value": 116520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773557807, "uuid": "90d1820b-dd2c-4a2e-b887-7da807cc1832", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773557807, "uuid": "01bdf41c-7410-411b-a947-86ed6c3889cc", "value": "Snapshot_Secondary_v3.1.bak", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc76e97b-208c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773592425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773592425, "uuid": "b3091bb1-7e3f-457e-b4a0-05dfbbb7dd5c", "comment": "Malware payload (Mirai)", "value": "73ad09d2e099ce8a4330768454c88dcf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773592425, "uuid": "caac5bb3-aa18-484d-987e-c440c4a44d72", "comment": "Malware payload (Mirai)", "value": "d01d522820f0dfa90c42778ba2ca73687317598efaf8023eabd4f34fa86809c2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773592425, "uuid": "4aeb138c-d177-40d2-9ec7-838d64352a51", "comment": "Malware payload (Mirai)", "value": "fd90355f6ad0c63b12f2e92678922cef37ac1502", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773592425, "uuid": "27fc2189-ed3b-4de7-85f5-27e7e281c8dc", "comment": "Malware payload (Mirai)", "value": "a7fd203c3172e38bc8108419cb4fe2d8f4b055e0d02cb78f5f58c959a3af43f33d94b9759c4cd7dd26f2f93fbb87fe07", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773592425, "uuid": "f831e01f-a780-4d53-b8b0-ecae01411b44", "value": "T14624D70E6E319F7EF7A8823847B74E709258339613F1C1C5D1BCEA154EA028A645FF99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773592425, "uuid": "8249db71-99be-4a7d-92fc-4306a188e7ed", "value": "3072:uynccrE2zqPK5fsKwF3qLOzVtFTQ6JXWHZkLHv/G/dhuSVFMAJombVQsBjTmKUv8:ocrE2zqPK5UNFTNv/G/dhDtxQZM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773592425, "uuid": "901c3121-cca1-4ac7-a528-ad440e40f789", "value": 217776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773592425, "uuid": "746dabe6-4244-4341-8fe1-58b31392271f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773592425, "uuid": "62106f93-edd5-4e69-9b13-8c2d27f8ff6b", "value": "memory_load.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58712330-2019-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1773542865, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773542865, "uuid": "a2a8549c-3de6-4134-b00a-cf12212df098", "comment": "Malware payload (ValleyRAT)", "value": "ea29744fffe0e05f3d8de0a849aca757", "object_relation": "md5", "Tag": [ { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Kepavll!rfn", "colour": "#301EB6", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773542865, "uuid": "7fbf0f7c-be92-4161-a546-7797111bed7e", "comment": "Malware payload (ValleyRAT)", "value": "d0655d9aa00a1e92b6b66ae9818b9e75234a515e550db729f6754443d5991324", "object_relation": "sha256", "Tag": [ { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Kepavll!rfn", "colour": "#301EB6", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773542865, "uuid": "c63783f6-85e6-439b-8dab-1e6e6061c2a3", "comment": "Malware payload (ValleyRAT)", "value": "1cef1f7eb117694982a6b06572a645d7b795bf03", "object_relation": "sha1", "Tag": [ { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Kepavll!rfn", "colour": "#301EB6", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773542865, "uuid": "b6801416-967b-40eb-bd5d-44ae77ff85f3", "comment": "Malware payload (ValleyRAT)", "value": "9bd984a1eea678e5bf9a5cf9fbd4623eeb10cd7e988325143a68bc1e0061f31d221fabb7971ba2444ebc754baba74819", "object_relation": "sha3-384", "Tag": [ { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Kepavll!rfn", "colour": "#301EB6", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773542865, "uuid": "109f3e67-b6eb-4bb0-a524-5bb9e40004f1", "value": "T18C183321B1666998E52F63BFD4B96FC880307DE1731BDA6BB3783FA449B064750B1903", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773542865, "uuid": "f62c7a01-af4f-42a5-9fe2-64fd57fb2726", "value": "1572864:SV+JCRBKqh/d8A2AVezThkfA3+ucbXpJ3iC3KEKgVb1rFPfcYvnmgAVHDyv:tJ6pANkakXEE7VVFPfcvg2Ds", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773542865, "uuid": "43bb10f2-e939-4f23-91d8-78dfa2cb1213", "value": 86017536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773542865, "uuid": "64b6e73f-bf52-4d32-953e-831034c0f102", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773542865, "uuid": "b256d612-2273-4dc7-b53c-c78e3852db4e", "value": "googlechr1.18.9.83.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f33fc381-2050-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1773566747, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773566747, "uuid": "c04cf4fe-d0f5-419b-b138-952ad939be9e", "comment": "Malware payload (Vidar)", "value": "7d3b5882c126fa17e789a9ff0ee43eaf", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773566747, "uuid": "1f54e0a4-223c-48a0-a0e3-8670306fcbb4", "comment": "Malware payload (Vidar)", "value": "d08902c5cfc095324199ff3e78b0f68eed9132e3b471f12b75a2ddc00260b4a0", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773566747, "uuid": "122b6d8a-55bf-4f8f-b281-a3f033eca6c3", "comment": "Malware payload (Vidar)", "value": "a31e6a514d2a7148a97383efef8d427f69e152e0", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773566747, "uuid": "51eac1f7-b8de-41d2-ac58-fb53f6a16400", "comment": "Malware payload (Vidar)", "value": "4c68335279639bfd2ca4ab6fba7b880ef63d544785d99915780b181cff8ec9cf4fa5758bc266b063ddd1ea05e917cf64", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773566747, "uuid": "f6b47fef-eca4-4140-a403-d4af156fe3a6", "value": "T125662A2BE2984269F16D813AC1E28B2399F370742B33C6F711551758DA8B4D07EFE6E4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773566747, "uuid": "bbc5e149-1ef8-4949-8908-fc0ec347e906", "value": "20aad64209ad1c0f921334c68abd4a57", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773566747, "uuid": "c827ebfc-6dc3-48cb-9984-23821aff0cac", "value": "49152:qdhZ2Glv68IJXFK2E4zmm9aSQQOFtRTFYS22tkBsuy4AdRGeM:pJ2tkBsZpKL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773566747, "uuid": "e88efccf-f3ec-474e-b792-d43f1b0ed11e", "value": 6870528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773566747, "uuid": "839983ed-dc76-40c5-8581-f1d04494e92d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773566747, "uuid": "261b3114-6b4d-4c0b-a692-690591aa74a9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ff73a87-2035-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773554796, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773554796, "uuid": "ecf68f09-1296-4051-9afa-19c16e894554", "comment": "Malware payload", "value": "807d03df013700eeac61f79dc371dff1", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "RiskWare", "colour": "#8F06FF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spotify", "colour": "#F97668", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773554796, "uuid": "a76ddc24-a578-47d8-a929-51f3f11b7f27", "comment": "Malware payload", "value": "d0a79f28baec2beaae749a8d64dcc4d1a79cde6982a72ede58945a843b563955", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "RiskWare", "colour": "#8F06FF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spotify", "colour": "#F97668", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773554796, "uuid": "a4ccf1be-deb1-4ba5-9893-a38c8878e352", "comment": "Malware payload", "value": "94fdeac415bbf2ca06ad7564c2a233a68d7173be", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "RiskWare", "colour": "#8F06FF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spotify", "colour": "#F97668", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773554796, "uuid": "ca53f4d3-97fa-4e9f-bce3-ee799848ac04", "comment": "Malware payload", "value": "5957d47f4effbec630e2ac254197841184d7af7b53099b5c3d45e273d2c24bc90eb6114e19c338b6b92b785206fa714a", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "RiskWare", "colour": "#8F06FF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spotify", "colour": "#F97668", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773554796, "uuid": "b7e2aeda-51df-4684-99c1-2c4e16c0b5e0", "value": "T1D3A5330D4D6A652FF57F68B6D420E9CF0A3742825CDE80E58F0EF4A43947A0DBBC5299", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773554796, "uuid": "ddb45125-4468-4157-a86d-a1b334d8d223", "value": "49152:wf2/GbWHW2RfhUsdO6IsU04Z7ORUsfLkJWcTBg+6JQ:m2+SW2PdBUMRUWL8xT8O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773554796, "uuid": "106632fb-66fb-40bf-aff4-39ca61c3c37c", "value": 2262066, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773554796, "uuid": "a376ccac-aa5c-485a-abdd-852f5e211d47", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773554796, "uuid": "7e30a1a7-882a-4ead-a0ff-c757c9ddd19b", "value": "spotify.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "293fd16a-205d-11f1-a769-42010a9c0008", "comment": "Malware payload (LummaStealer)", "timestamp": 1773571992, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773571992, "uuid": "75f09a5f-fd84-466f-b902-411bf579d73c", "comment": "Malware payload (LummaStealer)", "value": "ccf9b8449cf6b5632e7a1592cf76ad3f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773571992, "uuid": "a2ce4ac4-7f8c-47cb-a176-507d4ee4e5aa", "comment": "Malware payload (LummaStealer)", "value": "d1767af6135afca817ee432545b775fdca438df6039e76ef5ab6f81cb2e37f33", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773571992, "uuid": "6932dc1a-7f20-43d1-b91e-d6880602a271", "comment": "Malware payload (LummaStealer)", "value": "5c5bb5eb78627ffee7a4e918aa8e992d8786f55f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773571992, "uuid": "2847a9d5-38f3-4970-bd80-352d0c700bd8", "comment": "Malware payload (LummaStealer)", "value": "5f29308ef7021200cfdc9166663889c9e2287385f02bed405627034510f5ca042cb471776fe90a0ee92b4fecf7496cb3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773571992, "uuid": "5beb7d2c-19a0-4703-87a6-9d3c4b654ff7", "value": "T1EB25BF44E28278ADC31B9234A5769F7A89F03C31C7155E57C253F25E3936AC3A83B61B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773571992, "uuid": "b566d5ea-a024-428f-883e-e3c7359f0d2c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773571992, "uuid": "1d3bd92c-1489-4df9-b87b-67c43a510988", "value": "12288:Hmx08SHGoAYBTQB5zr1KcpiFCALt7PYNZPPsfKJUEevKJ58+dO3FQ9taMIBSsXU:QR+GoAYB25n1v2Ci3Eu4a8LIBxXU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773571992, "uuid": "afb59b86-38be-40f0-bee0-3480907aefac", "value": 998400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773571992, "uuid": "4c1dddec-a9ad-4ed8-b029-a5cf1382345b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773571992, "uuid": "a0263cb7-9a39-4ddf-aee0-e3d4d5d7cc45", "value": "d1767af6135afca817ee432545b775fdca438df6039e76ef5ab6f81cb2e37f33.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49074ca1-2045-11f1-a769-42010a9c0008", "comment": "Malware payload (MarsStealer)", "timestamp": 1773561737, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773561737, "uuid": "ed28603b-d15c-4d8e-9838-2497530cbae2", "comment": "Malware payload (MarsStealer)", "value": "abcf72df3558ad41efb76c467ddb9628", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773561737, "uuid": "1b223dda-6972-4081-80cd-ca6cf64b6954", "comment": "Malware payload (MarsStealer)", "value": "d2179f954fb900e8a6840ab87cbe0ec24782114ec6b0c4e559c841863085575f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773561737, "uuid": "bf0c73e0-12be-492f-b076-7e51b535dd2c", "comment": "Malware payload (MarsStealer)", "value": "7a6e6add661f4dabb1d87b859dbbff23cfd90be6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773561737, "uuid": "53a40fdf-2ae6-4b0d-a1fb-3c1b3f5843ee", "comment": "Malware payload (MarsStealer)", "value": "bce21dd18c14c87789fae999cd709e4c2e87142822f9a4c3e05339b3fa2691a70e6f377a5a9e107c6881366bd3f5be56", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773561737, "uuid": "38c0e9c3-0d5f-4fb4-a2d6-1a66e3f7a49d", "value": "T140A54A1227FA4209F2FF1B78B47951651BB7BD0A6A39C79E158CA4AD0BB3B508D10373", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773561737, "uuid": "3c67b267-901d-4fc1-a545-3311d9ab8028", "value": "a20218377378835f816db93bd4ba0e01", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773561737, "uuid": "80a52a82-c083-4bec-b6e0-58c37ff6011c", "value": "49152:rwW4DK4/t/ZFnPU5R4pKM7/jxPU5R4pKM7/jxPU5R4pKM7/jx:rwW4D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773561737, "uuid": "46ec15ca-ae5d-4f24-a99b-ec67125514d4", "value": 2147328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773561737, "uuid": "9e13735a-6196-48a7-9e5f-cba2dc3d4b2b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773561737, "uuid": "ba7cad78-103d-4538-a44d-99249425e2dd", "value": "d2179f954fb900e8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44781982-208c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773592224, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773592224, "uuid": "f123870f-94fc-4c3f-9074-958c815f4c80", "comment": "Malware payload", "value": "57e26175452cb133c52f6106e1c8e7c2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773592224, "uuid": "5028bc0f-497a-4c24-8b29-e86157e8e55d", "comment": "Malware payload", "value": "d22b676540ea0f5d64e1435239411a8e3b5814e07ea88b30d1842c1d35057926", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773592224, "uuid": "425d2493-6ce3-4906-9949-8072abb8029a", "comment": "Malware payload", "value": "721f7bdc638d1a2f9cfdf3cc5aa24bd415a2a701", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773592224, "uuid": "2afb2bc1-1c91-443c-9ef5-9711df59fb85", "comment": "Malware payload", "value": "08d4a8774800b215fd40a679edc30d8ecbb5e761973046e0348bf157c6648f36c82269e3b48364d64180db1b9349bf2f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773592224, "uuid": "043d5454-8c29-4d08-87e1-ba5e6b30fdb8", "value": "T15766192B639AC278F11EC63ACC93BB00A5F370748733C6D7199917699A46BD24F3A174", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773592224, "uuid": "d9c78869-d1b5-4323-9f94-dc7ed56aaaa6", "value": "20aad64209ad1c0f921334c68abd4a57", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773592224, "uuid": "bc75a413-421b-4b0d-bb3d-56f2a9ab9bf2", "value": "49152:fdhZ2Glv68IJXFK2E4zmm9aSQQOFtjTFYS22tomXliX2mM:cz2t/liX2m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773592224, "uuid": "6b8311d7-b790-435d-bee6-d7d0bb96b9e2", "value": 6480896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773592224, "uuid": "c6635e30-79c2-4329-8cef-59ff1b93b2aa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773592224, "uuid": "ba50c0c8-5323-45f6-94e0-b8f5decc136a", "value": "SecuriteInfo.com.Trojan.Packed2.51175.10075.6712", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "094843f3-2086-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773589547, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773589547, "uuid": "57a0eb30-df25-46b7-bf45-4900c943a4d6", "comment": "Malware payload", "value": "f6be9053fc562c6d5c58487178c09bcc", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773589547, "uuid": "5f256184-0447-419c-a3ca-dc2a9fe2a1d4", "comment": "Malware payload", "value": "d416f76290f56c503d16f8db41a5eb6c6702495b1397a5b431eb0a089582321e", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773589547, "uuid": "05d9db71-a7e3-4f28-8a71-24fe901b8bfa", "comment": "Malware payload", "value": "4a1b05b97cf2b2091598a86c0541abd3ef0cd652", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773589547, "uuid": "79dec4dd-df0e-47a2-afdc-2798168c0d05", "comment": "Malware payload", "value": "59ad89f06029939ee3b45702e365add79a7d121c2fb7779d0c9a2f3207ad78fecfce9fe5edfa3cb9983ad9b3047fc871", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773589547, "uuid": "4ef6bf56-53b8-4319-95d6-4086dbb09f95", "value": "T12B924BB506496C75FBC0CE799F3C7F0CADE582C42129E39DBA1F39705A2065DC60935A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773589547, "uuid": "547c20f2-c0fb-4e8e-8bea-58cf3ac06a46", "value": "384:nvncuxOLnVYMSczsO9a4cbddrME8jyfzsO9a4cbddrME8jy4:nUuQL+czsP4cbddr7zsP4cbddrk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773589547, "uuid": "4c61460a-d9d2-449c-bdf1-4b676406102e", "value": 19491, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773589547, "uuid": "f1790c69-8847-44cc-86e5-6aed2a7730f1", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773589547, "uuid": "99d0b49a-9910-4335-a3ac-617b7d936ef3", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c23ae7b-2035-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773554978, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773554978, "uuid": "c685ad59-08d8-4e86-93b2-b4c9a26a4cf3", "comment": "Malware payload", "value": "9d2e1f57325151dc12cfc6709230e688", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "BirBir Uz", "colour": "#EE9E8F", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773554978, "uuid": "72a46a4c-6f24-4a2a-bdac-8b44db68065a", "comment": "Malware payload", "value": "d47e517027efcdaae2280f6661fdf85a8429db585939776706e779fe2e373f0c", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "BirBir Uz", "colour": "#EE9E8F", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773554978, "uuid": "cc8e6969-3669-4648-8d47-e5c9c4f006d1", "comment": "Malware payload", "value": "4ad4e8f94f92ede193a15da11a0c9396df659880", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "BirBir Uz", "colour": "#EE9E8F", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773554978, "uuid": "344cdfe4-d0f6-4c03-b7b9-ce0bb640b416", "comment": "Malware payload", "value": "ab08f7d9dca4b6d20dbc9f0eecffc749e5b36af2f63f9adcd6059e3f2be0e9f121db94ed739418b113bf366074a8aa72", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "BirBir Uz", "colour": "#EE9E8F", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773554978, "uuid": "ecd78943-34bc-4cde-a4bc-656d3dffdf1b", "value": "T16B7533757AD26602CA5F99379316A6B27757ACCE0406F70B9340FF486DB264C8F07AC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773554978, "uuid": "58f0fa06-535d-4934-b0b1-2179b0eded27", "value": "49152:xQD1Fc2qSF3U4phruaehVtpbc56WZ0XB+T7sXoFWZ8:xQDTqS9pRu9hV/c5z2YQoFf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773554978, "uuid": "a48cb0f4-c1c5-4215-9c40-9b6b408c5d95", "value": 1632740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773554978, "uuid": "18a5d83d-2f21-4d1b-8c27-788fbd858bb5", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773554978, "uuid": "028ea08a-ad0a-4651-83d2-27d261b66a2b", "value": "Korzinka Uz.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f56ac92-206d-11f1-a769-42010a9c0008", "comment": "Malware payload (VenomRAT)", "timestamp": 1773578981, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773578981, "uuid": "ca97cd61-6e16-4087-995c-2f246cf9ad1c", "comment": "Malware payload (VenomRAT)", "value": "5237dcb1e6ecef53c17472b3832ab465", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773578981, "uuid": "64aac56a-e217-49e5-9a9c-c01928ecee68", "comment": "Malware payload (VenomRAT)", "value": "d6d876c7327482a6293fb5014393ace99e14aa7e0638bbda9fc602d35b8a72c9", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773578981, "uuid": "6772e434-11d2-403b-a1d4-e1c3084540b0", "comment": "Malware payload (VenomRAT)", "value": "7b84a29b91e761a7a36196078e2896fec884fd83", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773578981, "uuid": "b777bb64-2b48-40fa-871f-2d3da1db45e5", "comment": "Malware payload (VenomRAT)", "value": "e50d1da0aee0d7c565681d1457636e022e2f390525e7dba0f65245e6cea4e3917ad77a418162877fb1f3a9c5509b34ae", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773578981, "uuid": "bbaae110-4fd0-4229-820b-227c2ae9089b", "value": "T1BF841E2773698FAAF0C645B73250FD2005F1B78DB03BAAB6DCB56D093603574998B878", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773578981, "uuid": "f30d64f4-f8e3-4ce6-82eb-87991ef0ff63", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773578981, "uuid": "a8ad13c3-429d-4f1f-bedf-ed64d5b8c43b", "value": "3072:hUmcxg8vcyPMVZrzZH1bMBgQyTc3zirAYjBc34ucm0afVlY:hAcyPMVZ3ZVbsg+Gbtc34a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773578981, "uuid": "681706a2-efba-4745-820d-2729f490bb2d", "value": 381440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773578981, "uuid": "dc76e28a-a577-43a9-9db1-44d8ede9e6ea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773578981, "uuid": "a955ce2c-3ddc-445f-ad74-5532424a1732", "value": "HMC 2.0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35e8def3-205f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773572872, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773572872, "uuid": "b9928320-66e2-48b1-9a29-8d487b51043e", "comment": "Malware payload (Mirai)", "value": "0988f47ff3b405bfd01ae78884937ca4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "spc", "colour": "#540676", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773572872, "uuid": "2b510b7c-88f4-4b81-836e-e85ca647a0ef", "comment": "Malware payload (Mirai)", "value": "d6e0c5f65d7f33c1ff0b777c9c261ceb9f513db3914511171b5fb4ada52d0feb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "spc", "colour": "#540676", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773572872, "uuid": "1151a700-0b34-4d3b-b164-42ab97fbda75", "comment": "Malware payload (Mirai)", "value": "31036eb9722c7f7641e20ea6a99fc816816aebb1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "spc", "colour": "#540676", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773572872, "uuid": "d852cfa7-1334-44d4-b93d-e49d3c0e37eb", "comment": "Malware payload (Mirai)", "value": "f6a5458ef582badff711f90a4894253345f4caccb86a3cc4899ab3b585c800d36bab33570c1831f7a44c3acdbe9470cb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "spc", "colour": "#540676", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773572872, "uuid": "8135b8c9-8281-4b2a-9b22-0771252f5939", "value": "T186044B216E792D2BC1D4957E12F78362F1F7278E34B8892D3EB10E4EEF18250711667A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773572872, "uuid": "e9b6fafd-932f-4ac4-b0e0-56c6dbd8e316", "value": "3072:teNffNzj+vcCOpNeMh84olD4JVnfcMSBlB30Sz6N8NFFK1DP5kQ0:tbhmRz0D4JVkh9j1NIJ0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773572872, "uuid": "8c976022-e130-4907-8926-759dd41b9c1f", "value": 175624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773572872, "uuid": "4aed5f1b-c10f-4f26-8e4e-f5ec393c703c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773572872, "uuid": "31dfb821-6c7b-414b-be4e-0bea8fef4179", "value": "memory_load.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5210aa17-2073-11f1-a769-42010a9c0008", "comment": "Malware payload (LummaStealer)", "timestamp": 1773581509, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773581509, "uuid": "5e0f095b-7fe3-4ebb-bee0-c1a80a0cf738", "comment": "Malware payload (LummaStealer)", "value": "7637060c4ab357158b43b98edda0c0ee", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773581509, "uuid": "a0e82a45-4f7f-4b41-9364-295d2e2abf0e", "comment": "Malware payload (LummaStealer)", "value": "d936e32af2f6552c30c61a844ad327920488271125d8c5536eba8fe7ca004ece", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773581509, "uuid": "87dacd54-38f9-4376-a265-87b0c06012c3", "comment": "Malware payload (LummaStealer)", "value": "f2fca171ef41225a1ae5de720d52cb9a02ea8d99", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773581509, "uuid": "6cc96661-16d8-43ea-90e3-6d8e2b4658c2", "comment": "Malware payload (LummaStealer)", "value": "ec2e21d98b7df8dc54d25457f1138ee541df98b287b7ff6d666b2f5e6bf86c1e505c62e3ce11ad9dce7479dc7b5a8374", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773581509, "uuid": "0518115f-235b-4e5e-a225-b3bad6ddf037", "value": "T1A825C406BBE9C5A9F4A706345EA5D3FC1173FBA0EE51828B79D5E34F1C31A908D24632", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773581509, "uuid": "4b061759-ad6a-4c11-9007-c16d1496c6ab", "value": "efd5a1321fb3549606827ae52de6c65d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773581509, "uuid": "2ea6c126-e1cb-4efa-bd33-04740159cfac", "value": "12288:p4HXvA7HyYyK/QCEtJfjYTMVcuiWIKK7fuzz5hVkmviAHNxWBz:p4HXvAjByEQCEtpmSiWIvD2R7WBz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773581509, "uuid": "b4882e7c-584c-4f35-92d2-5d8910a5baa4", "value": 982528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773581509, "uuid": "f257c306-d26f-4de9-9ca1-74c684c0258d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773581509, "uuid": "709d1b64-92db-4ca4-9f50-4496684274ae", "value": "d936e32af2f6552c30c61a844ad327920488271125d8c5536eba8fe7ca004ece.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5472da1-208c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773592440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773592440, "uuid": "252920d8-711e-4209-9cdd-cd70d4a5415e", "comment": "Malware payload (Mirai)", "value": "f1e0c2eac1995e0d2e6e7db4c6e3b871", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773592440, "uuid": "6fce1ab3-4e9b-4eeb-8b6e-2f2defc88075", "comment": "Malware payload (Mirai)", "value": "dc33c6222faa55cb7e94b907eb02c330d2448fb594359e5b6db749dde9a4fc28", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773592440, "uuid": "1950535f-7d68-4a0e-bff1-5c05b24c3878", "comment": "Malware payload (Mirai)", "value": "daf37a614a48753f62a8b855bd9896d7dcd45e9b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773592440, "uuid": "44899c91-c934-435f-a36c-02c081c82136", "comment": "Malware payload (Mirai)", "value": "dfc2a07a3da92595d11282dad2991ffe2573c1e600fdcc922a604054c4c441adf95231af54270b39dc302ebe1c682eea", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773592440, "uuid": "e3c2fe7d-0a3b-48e9-a53b-1586cb02ab1b", "value": "T1BDE3BF32C0B8ADD5C089467070F89F7C4B65A91469736EB6C182DB2A9047FECB50B7F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773592440, "uuid": "8f9fe8d3-51b1-4b04-9451-ecd420a8c997", "value": "3072:bgSCR8T0NweWaCV/37j0aSyrqKR4ZqRAtNv2Cwq0v50V:bTA8TG2P/aK2Zqub2a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773592440, "uuid": "196a63bf-0236-4685-8a7a-24e54bd9c70c", "value": 157132, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773592440, "uuid": "8f58f784-d5ad-4ca3-89ac-7c57e8dfe27c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773592440, "uuid": "2d4d97cb-8f86-45c5-b668-75a7b14ad5c6", "value": "memory_load.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8ed06cd-203c-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1773558086, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773558086, "uuid": "b3643361-8f8b-49b4-9ccd-c02aeb1fdcb7", "comment": "Malware payload (Vidar)", "value": "0ffb10a129af3f1bd3463c4df23443db", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773558086, "uuid": "6f1607f1-968a-4f06-876b-ebcc6334604d", "comment": "Malware payload (Vidar)", "value": "dc8308cff8462c96f8a9b9cedaa4d0711d590a532df4ed1084dfc6c4769926e1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773558086, "uuid": "ffb94fe7-968d-4fdd-97cb-f5e33ddc1609", "comment": "Malware payload (Vidar)", "value": "c25b3cf29cdcc3ee6c9fdb3f04fa2c354dfe645a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773558086, "uuid": "f006b8c5-5b97-4a93-be4e-f78c298203af", "comment": "Malware payload (Vidar)", "value": "a8f560b7544034e6d66bfdabfab598da75cdcb15bb061e850ebf3b7699d543275c98ade4db49350a2efe8f9e1e9f0fcc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773558086, "uuid": "4e053953-6123-406b-b3c9-6bddf53344fb", "value": "T1A9E409BD9C60E326F70C90BAE242D752CF2139051236A6A319BED3241245972DF677FE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773558086, "uuid": "490c2b8f-d165-4d45-b136-673da90ea193", "value": "12288:OaqyhmuIzDEXSVm2qg0SsRQwbV72HYuNbs/a/0xMVxEZKxb2O:OTyCDR/qgXsawJ6Y1MMZKxb2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773558086, "uuid": "6b41afc8-eeca-47b8-8724-c158e18889df", "value": 657408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773558086, "uuid": "35e58898-2554-4469-9988-fc82bf64a158", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773558086, "uuid": "582aeb49-1e7e-4d23-9f64-e057977b17bf", "value": "eNLe4nm.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72a038a9-2080-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773587147, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773587147, "uuid": "03a1d103-1ae9-4542-83cf-3933e4b2da66", "comment": "Malware payload", "value": "f3bf285ca4634797fb63b05b9cb8dc23", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773587147, "uuid": "42cb22fe-7f98-4fce-a010-55ed032d674a", "comment": "Malware payload", "value": "ddad63744f93537d16b00da6612fcde0a33e71818429096e83a7bbffe7ae6f38", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773587147, "uuid": "f51b8196-3a79-44fe-88de-69040cb497f0", "comment": "Malware payload", "value": "374bf0d40f7c8359f87586320a1af78c5f394c4e", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773587147, "uuid": "daf70ac4-6477-4432-9ca6-49199d7fd074", "comment": "Malware payload", "value": "70a10bf547c754738f16f24505663cd2307e3d4e6dfa319719bf857c96f1dc86a113fbda97a8aebb96d653c0758e10c0", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773587147, "uuid": "363bb245-8b34-45bb-9c32-5ffd2e2eee24", "value": "T179924DB512896C79FBD0CE399F3C6F4DADE882C42124A3ACBA4F39215A1166DC70535E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773587147, "uuid": "0ef3ffbc-adf2-4641-8a87-929dbc365214", "value": "384:MFcuQpWx+BL0SWL0gVzsO9a4cbddrME8jyfzsO9a4cbddrME8jy4:MF8i+BL0SI02zsP4cbddr7zsP4cbddrk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773587147, "uuid": "045d8454-3c61-4dac-9745-8b760dcd49ce", "value": 19499, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773587147, "uuid": "5e549a64-de47-450b-8d7b-1dd31a5e7c73", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773587147, "uuid": "d63a6af0-7e77-4541-a3c9-680ca70bf798", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "646bdea0-2031-11f1-a769-42010a9c0008", "comment": "Malware payload (Triada)", "timestamp": 1773553193, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773553193, "uuid": "93980464-32aa-43f6-a5ef-46e65a8ef8c7", "comment": "Malware payload (Triada)", "value": "08fd47d4579bf2aa54a834368943d99c", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Triada", "colour": "#9CEAE8", "exportable": true, "hide_tag": false }, { "name": "Whatsapp", "colour": "#639D48", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773553193, "uuid": "94804993-b5ee-4ae6-8c03-86379b59839f", "comment": "Malware payload (Triada)", "value": "de7d54276047fc457271b582a378e9599ce0b3822d4e9cb89a1260f81a3c2644", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Triada", "colour": "#9CEAE8", "exportable": true, "hide_tag": false }, { "name": "Whatsapp", "colour": "#639D48", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773553193, "uuid": "3b88399e-fb1d-4cfc-a3b6-b388adba40b0", "comment": "Malware payload (Triada)", "value": "e6ef8f7908683eb6b9583be77c33cbc055d1b7fb", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Triada", "colour": "#9CEAE8", "exportable": true, "hide_tag": false }, { "name": "Whatsapp", "colour": "#639D48", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773553193, "uuid": "77efcccf-75a1-4663-b562-d7b2c063ec96", "comment": "Malware payload (Triada)", "value": "2592b31d3d4f61973df2cbc3993f50376ab9eb8e66c2d7f126aa95852cd99613411f60b5ebe323328a35ed2f38ce98e6", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Triada", "colour": "#9CEAE8", "exportable": true, "hide_tag": false }, { "name": "Whatsapp", "colour": "#639D48", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773553193, "uuid": "53eb0473-f9de-4aec-b291-46444011c2fc", "value": "T16528128AFB8DDC1DC9F759319B0A5BE6560D5E244A52E7D72B00720D2C73AE84B0EDC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773553193, "uuid": "01b880c4-96d3-4e47-9c55-1333dfc2d483", "value": "1572864:OuKALSX9ZlRAJwrXw4zDNcWotB1szAJqOij98CYSGQcabbCT1VbgzBKuEd:OuKALmleuk4zDNstIOy8CYStDfCSKR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773553193, "uuid": "7cf887a8-e722-451d-870f-18c75e6fbec6", "value": 99587225, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773553193, "uuid": "07f577e4-f179-42e0-89d6-d742235d7d25", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773553193, "uuid": "6092ef27-90d8-49db-9984-db8f57a0141f", "value": "GBWhatsApp_Updated.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41a951c9-201a-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1773543256, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773543256, "uuid": "34b62eb4-6914-49b6-a584-3e49ed40d20d", "comment": "Malware payload (ValleyRAT)", "value": "827f50878b6458334a8bd5a3495fd7a1", "object_relation": "md5", "Tag": [ { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773543256, "uuid": "2039e212-ea96-467a-a133-d9884ae4ed2d", "comment": "Malware payload (ValleyRAT)", "value": "e23585aefbb887977440af86195fe0ebf7763e10f2255217dbde7c1545de0a27", "object_relation": "sha256", "Tag": [ { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773543256, "uuid": "54d9ebaf-9987-4fff-ba0a-f92781dc62c8", "comment": "Malware payload (ValleyRAT)", "value": "0ea7fa8db249018628cb18f714627d20205933e7", "object_relation": "sha1", "Tag": [ { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773543256, "uuid": "a6d9ee84-8296-4770-ae9e-2681d24df415", "comment": "Malware payload (ValleyRAT)", "value": "bab4cf803501e5937bd0ce4dab53ab9d1e355de0cb02d380ed5b0fabccfbbbf8d4471f75a57aa7cfbdd9c549eadac6ce", "object_relation": "sha3-384", "Tag": [ { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773543256, "uuid": "359bdf6e-fc1d-4e47-959f-4053956237fa", "value": "T18EE5338506029A91D79FD23332E31B35B4F2577AB2D7B3D121BBD48FB82782C415A64E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773543256, "uuid": "c6d38c4c-4cca-46d4-94ec-896a462d6d3a", "value": "49152:r8lVKThUFV7l473R+gdjTP+81aa2Lh3QegYvx3rliSBUi5bjBlcOwx+kxyeso0EK:rRNkta7htjTn1aa2lfZ3xiSKiRBCfy6u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773543256, "uuid": "95a59edd-66c7-45fb-afac-fa5f534e927b", "value": 3025059, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773543256, "uuid": "d0ab1d35-cd0b-4436-a09e-97ec6b49bd77", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773543256, "uuid": "d4c2eb52-a771-4690-891c-37214e6673a3", "value": "YnA2FjA.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "556d136c-20b7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773610720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773610720, "uuid": "0ba586ba-ad0b-4376-832b-83d50ba2e8c2", "comment": "Malware payload", "value": "d90396ebea8a4137b9f9d85351b754bb", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773610720, "uuid": "b86bc568-c4d0-4fb7-81a4-c1c61a756baf", "comment": "Malware payload", "value": "e4e28070e156dc118ea6b4c38a6a137769aeba47cc4feb0daf0ccb5d3f440d7e", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773610720, "uuid": "a6852acf-9c41-4cd5-8923-4c70b4b0b2df", "comment": "Malware payload", "value": "201f372940edcc827000afc7fec31bef6a493540", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773610720, "uuid": "ccdb2259-8e6f-4927-8f21-9845b89eb135", "comment": "Malware payload", "value": "c8704e4668ea59b81d8140ad9b3632135143f7e5417028975e73bb6c2873950118da5b6945bb6a6846574cf8f9e55d93", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773610720, "uuid": "5dc0716d-8ccd-4f97-b0ba-b5247fc4a0f4", "value": "T188925DB512896C79FBD0CE39AF3C6F4DADE8C2C42124A3ACBA4F39215A1166DC705359", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773610720, "uuid": "9629389a-caaa-4148-ad25-d61e581edc41", "value": "384:x4FcuQpWx+BL0SWL0gmzsO9a4cbddrME8jyfzsO9a4cbddrME8jy4:x4F8i+BL0SI0lzsP4cbddr7zsP4cbddo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773610720, "uuid": "5ced36f1-cfd6-4e4e-9ad4-c5ecfb12e0c7", "value": 19499, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773610720, "uuid": "5be1f2f9-ad63-4451-8582-11501be8c624", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773610720, "uuid": "700f48ea-77d7-4143-995b-7352a23e29be", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72c8b015-20bd-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773613347, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773613347, "uuid": "83cc3fcb-2566-4ba3-a7f4-fcedd07fdee5", "comment": "Malware payload", "value": "55d8983f2d1f2db0d3a19ca614081cfb", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773613347, "uuid": "35de8378-daac-4752-a0c8-c8d67c3fbe5d", "comment": "Malware payload", "value": "e561638a2c49f88f7aaf87eaadd9a7731ae3c31e5cb5c29970685af4b7de8639", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773613347, "uuid": "f2b822d7-917b-4a2e-91b1-4e13c2917a47", "comment": "Malware payload", "value": "9011307687724adad8dcf7f6ca5cc85312575564", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773613347, "uuid": "320c3c54-2707-4a6e-bf61-0ede41e22f8f", "comment": "Malware payload", "value": "f7ff3e71ac9c0144b75ad4deceb6ed66c675e99fa26202d11b179fca87f4b6965e4808822c6269d0f8d70861d4844b80", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773613347, "uuid": "44ecf555-ec7e-4cdd-8e29-62ec4612e3d3", "value": "T172B617EB36E24568C15D833AF1B78B01C5F362B90777C7E741A807AACA725C49D7E920", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773613347, "uuid": "544a7671-d6dd-4c61-b8fc-059ba71b9b6d", "value": "b8399aa8e7b34c992334ad63f681f404", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773613347, "uuid": "d9670410-f031-4ce3-9a92-24bab4d5edad", "value": "49152:t3BDMNyKXcTCa1C7hoaeKEvj995SA50moXGQRdReVTVzzXtdF6UYIs2AtrkhYYq3:qZ9efRSphYq3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773613347, "uuid": "6598f7b5-a5d8-4c18-93dd-dc007957b1f0", "value": 10766848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773613347, "uuid": "9ee1a3d6-5650-432c-935a-4372880bdc49", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773613347, "uuid": "b438ba51-7735-4267-9f56-e85acc391cb7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2e1dae2-2040-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773559821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773559821, "uuid": "c31dc040-326d-453c-a9c3-b272ccacb439", "comment": "Malware payload", "value": "f6dc569118ecaca1615db75a5b10b8b3", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "Goi", "colour": "#A81DA4", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "mparivahan", "colour": "#29C0BD", "exportable": true, "hide_tag": false }, { "name": "RiskWare", "colour": "#8F06FF", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773559821, "uuid": "0d675afa-a4f3-4bd7-8466-4e7f88e151ec", "comment": "Malware payload", "value": "e9630dd62cb4a53f759d620884205b2c6a1fec90cb65f2c34334488cc826ee9d", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "Goi", "colour": "#A81DA4", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "mparivahan", "colour": "#29C0BD", "exportable": true, "hide_tag": false }, { "name": "RiskWare", "colour": "#8F06FF", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773559821, "uuid": "f840b7c1-fcc2-4c33-bf66-3043ee15e959", "comment": "Malware payload", "value": "0e72fa76e864903bb449b8bb51ed9d73ceafcb41", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "Goi", "colour": "#A81DA4", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "mparivahan", "colour": "#29C0BD", "exportable": true, "hide_tag": false }, { "name": "RiskWare", "colour": "#8F06FF", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773559821, "uuid": "a04c0633-48df-4f27-ba25-591e3e9224cc", "comment": "Malware payload", "value": "ef5fdd92cd55b7fdee4fff811f0449aaba92546de60a4b545ae8fa2615d8fe2088054f1895d6c028638eafa8767553ab", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "Goi", "colour": "#A81DA4", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "mparivahan", "colour": "#29C0BD", "exportable": true, "hide_tag": false }, { "name": "RiskWare", "colour": "#8F06FF", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773559821, "uuid": "0be1030c-ab0d-409d-bde5-a1aa636255e6", "value": "T1882733A1114F3EA3F15211323475619B574A36C7F88552CBFE7582AF9860341F32AFBA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773559821, "uuid": "32e806b1-5886-4a5d-a71e-a9a38c23df57", "value": "393216:bGoXWG+MxyCMU6b2wUK1Vo/WWD0V6MVnRQqWeA8L+JjBS6oOYdAxaA:bG+WGrl6R3VKWNpVnRRaJdoDAL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773559821, "uuid": "a8834a33-9d01-4928-a684-a70d030f4341", "value": 20964324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773559821, "uuid": "312ba7d6-d772-43dc-a0b1-c8ef47fd96cb", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773559821, "uuid": "358bcc32-2f34-4818-aa1e-d8cc57f840bf", "value": "mparivahanextgen1801.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1001807-208c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773592433, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773592433, "uuid": "5cd754ee-b7d2-483b-b8f8-9f2b59cd132e", "comment": "Malware payload (Mirai)", "value": "9763c862736ea3ad1a0a838847af5e45", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773592433, "uuid": "e81ceaff-9978-4320-9343-d161a954e87f", "comment": "Malware payload (Mirai)", "value": "eb95d8f05f8d56f7cf5fcd85407b012a10cc18592fd3a34c62afd4740ef081b7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773592433, "uuid": "a67c7982-a16c-47b6-afe4-04b864ea1bc5", "comment": "Malware payload (Mirai)", "value": "60d23dc8044ee96dae13ce69892fb0c16c3903ad", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773592433, "uuid": "a893d546-0b6a-467b-982f-e73fa10b9f12", "comment": "Malware payload (Mirai)", "value": "2b7b4edc8d79b0d92d3c0a55d3e05422844310e3d22cc152f6b9131f9f570a482d9db2f341e320ba219ed0aeef0677f5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773592433, "uuid": "fba6bf3d-adac-400f-a8a7-6ca2434b634d", "value": "T1B324E60AAF211FFBE89FDD3746E91B46149C591A229D6F31BA30D818F14B24F1AD3970", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773592433, "uuid": "9adeafc1-f220-421c-b9be-2059c482a3f6", "value": "3072:tDTu5sYbTaS7LXdJLlmfKgJME29gHPp2EotNj5u1LCTdWKTv50j0:aHbTIf1NX0NA5Ce", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773592433, "uuid": "c0614a5f-6286-4d61-b5ca-f508dd4c7332", "value": 221456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773592433, "uuid": "f76884d4-526e-4aef-934d-e1702efa49d8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773592433, "uuid": "219457a4-62f9-41af-95dc-8caef61d8902", "value": "memory_load.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bba0e2d1-208c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773592424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773592424, "uuid": "1b8dca03-640e-410d-9b75-9bc617f7c1fc", "comment": "Malware payload (Mirai)", "value": "b3f9a2219202b05916cd145db6812875", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773592424, "uuid": "aa92841e-a1dd-45cf-8b0e-e4421d8754a8", "comment": "Malware payload (Mirai)", "value": "ed5002a5a272fc0e10e8f90470ea9c96231623c8a412a13994450d0e5426224e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773592424, "uuid": "d1f8ac78-84b2-42da-8363-2658746889ca", "comment": "Malware payload (Mirai)", "value": "3919df0f8a1d7aec4cf3cb6b29b4c0cf5d3a896c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773592424, "uuid": "873e7b2e-597e-4d1e-8fde-0aab4bc3c3ec", "comment": "Malware payload (Mirai)", "value": "000423f1223156de80d32b0d91aa4c8bbb23a1fde78377a1ade1051b6c2d711f938d2a8aca0c3003d6ec7fbde5e02c84", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773592424, "uuid": "8bb8aadc-fd64-4a11-bb3c-db515e25785e", "value": "T1B3E317B16419F6ECE8E110B8F01314E725D1482C3DDED4E2B197A1BBEFB6748A429D4B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773592424, "uuid": "2a035e45-b2fb-4b37-a253-740c4ccdcd65", "value": "3072:jNei1Rah/ZVJIgyQD1Rsh+8SMw7VZusjB1uhdzio25nMQ:jsioxVb1yh+tQsl1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773592424, "uuid": "bd057114-3126-4221-bf11-1cd79737c732", "value": 157276, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773592424, "uuid": "aeaf3c37-9b55-4816-a9fb-7ef2660052d8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773592424, "uuid": "6753fccb-6bbb-41d7-9c6c-ab72341f83d8", "value": "memory_load.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf48c6ca-208c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773592430, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773592430, "uuid": "04c4236a-3109-4c51-97a7-33f5755334a3", "comment": "Malware payload (Mirai)", "value": "6ed32ae60dadbcea142964dd45099f61", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773592430, "uuid": "17193164-0e19-4289-bd6d-4b4b68f7111b", "comment": "Malware payload (Mirai)", "value": "eead2f8c3a455792b6a8f849972fee9f195c25fc5fb500ee360fe91c2ec1f86d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773592430, "uuid": "d774012a-a0f3-4523-aba8-c945f19079e7", "comment": "Malware payload (Mirai)", "value": "6cad5eee4a9ce97a36977d9dbc1da63f852cf78e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773592430, "uuid": "531d9e46-3817-4fba-8020-b3c9a6159fe5", "comment": "Malware payload (Mirai)", "value": "180ae96b1523aa328cfabae50fb0f04a335e107538de6c26336053c857a7ce6d117a550c63c641738f7110812ea1dd4d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773592430, "uuid": "83e958f3-ec38-4859-9d26-1a49dd543006", "value": "T196042B86AC909E15C6C126B7FE2F018E330657ACE2DE72528D245F3477CA92F0E3B655", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773592430, "uuid": "6cd24915-fe4f-4d2e-a3f5-1b8ad925e3e2", "value": "3072:1xItC40TYmzXOGpIT6K1EfDlmq4DerAq9msGqDQgg7T4ZRcraXyuTkaU+DGJdqvU:8tx0ZzXrFlfmKAwkgRc7uwaNjs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773592430, "uuid": "5fedf08f-e0ee-4200-af76-b07abfe9cee7", "value": 185912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773592430, "uuid": "9b7ffeef-1c3c-4c90-b092-c4bb8f5d8a1c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773592430, "uuid": "87e7f631-700e-47ed-acac-38948186c83e", "value": "memory_load.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66796601-203f-11f1-a769-42010a9c0008", "comment": "Malware payload (Stealc)", "timestamp": 1773559209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773559209, "uuid": "efcbf955-ee00-4da3-bfe9-509cceb50e26", "comment": "Malware payload (Stealc)", "value": "9c84df0e11873e00edbad27ecb92437f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773559209, "uuid": "cdc9ae3b-000a-4091-9cf8-14ff2cb65bf1", "comment": "Malware payload (Stealc)", "value": "f027e032f6c628005a69951df10c6c11069c55e792b6b2cff1513ec043a7474f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773559209, "uuid": "48b80a19-4a5d-496e-9b69-1e55c7a641fd", "comment": "Malware payload (Stealc)", "value": "3e7d84c30cfd8626d000d5c702e04c5c32b4e271", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773559209, "uuid": "d8edcf27-0319-4365-a68e-406d1d0ba200", "comment": "Malware payload (Stealc)", "value": "f891fd0daa8dfe0f4014a59edbc18dbcb1f08b72c11f704d3134c369d722ab404ec9ad77ae2e2ca5ec28d0523dba3f4e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773559209, "uuid": "605af419-a163-4ed3-be4a-ef02d53b8f99", "value": "T1FFC5D883A2531455E14AB370B54D01E58781EEA205E4BBBFA8F2FE683FA41441FF3A57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773559209, "uuid": "d3c0b9f5-7734-43fe-86ea-3a8155e37e58", "value": "96471588a0ff89e8a7af662d781a6ad6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773559209, "uuid": "33c47990-30c3-46b3-b579-3170305b9df0", "value": "12288:1ngNHRw0czPui10dSzWAUAkvHM3GL9WsgJvJafWFwURUVzf:UsbuiKdSzOnvsm8Jaiw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773559209, "uuid": "93b04e60-a1cc-4733-8dc4-1bb2802f18cf", "value": 2683904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773559209, "uuid": "7fe5fdc9-d70f-4017-9104-91f206e7c7ae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773559209, "uuid": "8d5f1806-ab71-4d7b-bf30-fcf51e7f8a3a", "value": "xf027e032f6c628005a69951df10c6c11069c55e792b6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d70e1df7-2015-11f1-a769-42010a9c0008", "comment": "Malware payload (DDoSAgent)", "timestamp": 1773541359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773541359, "uuid": "eb57e1fd-f7e2-42dc-836b-db47fd2d1562", "comment": "Malware payload (DDoSAgent)", "value": "dfe902da14be352fa54595f430cf17f6", "object_relation": "md5", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773541359, "uuid": "87ad73a4-ce8c-4e4f-a8cb-462987745505", "comment": "Malware payload (DDoSAgent)", "value": "f02a038797f449d63d32d2eae14ddab662c6f14e9e279ef1eaa01a400fdbefb0", "object_relation": "sha256", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773541359, "uuid": "309752fc-7168-4650-be7a-a9f185612b21", "comment": "Malware payload (DDoSAgent)", "value": "aed1dbd8009b6574a88c170fc2d296acdd018266", "object_relation": "sha1", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773541359, "uuid": "e9600b43-39c7-46e2-a6c6-31e3f835fa68", "comment": "Malware payload (DDoSAgent)", "value": "b0e20f2b2397417bf20e77923c4cdd00230fa55398252a59d26d1eea30e07fc7990231c7abd6565d8b1eee5f57d67a19", "object_relation": "sha3-384", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773541359, "uuid": "e3a4f330-c2c2-40ff-9fd0-05698200d151", "value": "T1E9157D5BB2B374FCC057C43043ABDAB2A935B42542226E7B65C8D7303E17E741B1AB66", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773541359, "uuid": "b4d47c55-3a25-4bb9-b16d-bcebf82bb358", "value": "12288:hQM7I2RvcLp4spHD/zmkxgw2hAI+voaFvBfmt3jLSxqjGLHqn9f7/8dzuFbFJy1K:hhII04sAkxbiawEpfmt3jLSxB2fgJG3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773541359, "uuid": "09064d6a-c1a2-4e02-a3f6-32d618808935", "value": 898760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773541359, "uuid": "0a923905-495d-4c66-bb61-6976a01f1588", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773541359, "uuid": "c79b9904-e819-4ff7-bf0f-4186fe2261d4", "value": "data.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "313c28e2-205f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773572864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773572864, "uuid": "45909332-b172-4ff8-9cea-2db7f6c631e3", "comment": "Malware payload (Mirai)", "value": "388402b86a6f6851bd7a33260652bf33", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "mpsl", "colour": "#F498C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773572864, "uuid": "f3b4cdb6-2cb2-42da-a790-6fca95fdea43", "comment": "Malware payload (Mirai)", "value": "f13a49b2e52d20e6b79100f30fadd9b6dd57dd382da8a7e0898e08c1134a15e1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "mpsl", "colour": "#F498C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773572864, "uuid": "3bed55ae-b64f-49d6-9d09-a2a378190e86", "comment": "Malware payload (Mirai)", "value": "41764ce8478b0fc76685313a0ca67ca45f67a0e5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "mpsl", "colour": "#F498C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773572864, "uuid": "41ebe8e7-7df1-4903-8264-3cc68a49734f", "comment": "Malware payload (Mirai)", "value": "0939f2cf3e32cb7e0a18b21697c926a09e2368cea98d39418de98d80763faf11bb093d3ddf68082511923a3f23ca1d90", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "mpsl", "colour": "#F498C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773572864, "uuid": "08c3ba9f-f4a1-4e70-ab4a-aa4061b40eb3", "value": "T16F24F70AAF211FFBE8AFDD3741E91749149C181622997F75BA70D818F24B24F1AD39B0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773572864, "uuid": "54744350-1ed8-4a69-93cb-52e1ffeabf79", "value": "3072:HHpQeXRNzeiN1tPtHF8LgwbMH1APN4+M2sToMec1dDi4NWKLv50jxF:pQMJeTDA0cjeUDiv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773572864, "uuid": "41eb00fe-07a6-4b64-8e3c-637108556fe3", "value": 218712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773572864, "uuid": "6a5fa8af-57a4-4eb5-909c-57de462e3132", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773572864, "uuid": "2fae8a4d-e99c-44af-aee9-b590d6615d79", "value": "memory_load.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6ea05dc-203f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773559344, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773559344, "uuid": "aa90716a-5478-4e73-913f-37c841c5076d", "comment": "Malware payload", "value": "0d2e9707994bda825554b6f9987dc89b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773559344, "uuid": "621f21b3-8856-4c53-a5ce-4f1f4c47ab82", "comment": "Malware payload", "value": "f542970b4c7b4fe96b3061c15154df17b33e9b0d9f403060bcf036c99e8c01ea", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773559344, "uuid": "b04adfbf-73aa-4f86-a611-db4be46d5299", "comment": "Malware payload", "value": "01331727884cb54178fb13a4c6f4e54241686dcb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773559344, "uuid": "e85590db-9ea7-49e1-a79b-f847f98d7e69", "comment": "Malware payload", "value": "54c6869012180300fe88eadb72f3f86c3740ae7f90287531f1b112b07a9e7c6d2fc12dabc31928e33b7e46f78d143531", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773559344, "uuid": "6a2bb7e1-fd9d-4327-afbc-9cbbaf1375ed", "value": "T10E56D69758DB0DA2DCC6277C75D7633AA771FD62CD2D1A6F9644D02069A32C02F2EB80", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773559344, "uuid": "eda276b9-2785-4c98-b4ff-2ccc49106f4b", "value": "3c86ca01cc817a473cc295dd1eb3ac10", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773559344, "uuid": "278b3252-f3d1-4a9d-8ca3-de52958d6f51", "value": "49152:3ZlDFjvMb41GLRkiQWlHireJ6v+7HjSwVKdX3dOd+dFdrdedfdidsd7QdsdX1dYA:dIJN6ZeZcS5huGEYcnKEdckK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773559344, "uuid": "4fe35940-6eb7-41b3-8331-83d12570f8c8", "value": 6313481, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773559344, "uuid": "29340c82-1888-4f16-bf6a-c8a01bef091e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773559344, "uuid": "11afe4b7-7372-4021-ad04-879eed743960", "value": "AfterFX.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b25d989-20ca-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773618864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773618864, "uuid": "b7cf95c1-75d6-49cc-a6bd-47e9c1968b3e", "comment": "Malware payload (Mirai)", "value": "e3199d04a150836ccd4c8f5513543a64", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773618864, "uuid": "5f527725-1f8c-4c39-9748-fc229deb5fe8", "comment": "Malware payload (Mirai)", "value": "f94c92c290b12e214ae57105c40fe05d89fdd3b625c18eeab40f4daefa55ebd5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773618864, "uuid": "b231c382-714a-4a1c-9523-ec315503cb60", "comment": "Malware payload (Mirai)", "value": "a2a5e06c4a6d9e9ca27f0c87ad173825702bece4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773618864, "uuid": "bd302444-1a36-4251-a5ab-6d5ecded8216", "comment": "Malware payload (Mirai)", "value": "55c8f9e3de4dc8819d523e70346b6b5ece59df04669052302dc35193f0c1762b7a1fa305898e8cc5b89ec51508e1f5fa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773618864, "uuid": "29a013ab-ed36-4e41-b77d-4ecb0502a740", "value": "T1A3832A95F9814B21C5D512BEFA2E118D3323177CE3DE72129D10AF21778B96B0E3BA16", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773618864, "uuid": "7fa0c387-c86a-42bc-a6db-0dc2d49c7981", "value": "1536:4wnW6LltCc1HFwafnA/vAa4Ww11Q2M8i6+fghe3U7AL5YGYC61d6dOO:BhtCU5A/vAa4V+fghe3UUL6GasO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773618864, "uuid": "d8948994-d1d4-4a99-b4d2-32e73df946a0", "value": 85492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773618864, "uuid": "000a30c7-fd3e-4477-8251-15d93aea73f1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773618864, "uuid": "5ce02215-37c2-4851-a70c-d96a3da08ee8", "value": "parm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce92a6b0-203f-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1773559384, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773559384, "uuid": "2a7dedb8-e8f6-4bb4-9010-c067e4a6bcd1", "comment": "Malware payload (SalatStealer)", "value": "c1d6ad0aebd37b3f51e3021895c88150", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773559384, "uuid": "e65d5c7f-db6f-4ede-9e54-f7db65149dfb", "comment": "Malware payload (SalatStealer)", "value": "f9c74ee2704b72778edb50b0e710c975b16ab87afb85fe23b5f34d3e6803f636", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773559384, "uuid": "92317df1-8dc7-4a32-8654-922c7d67734b", "comment": "Malware payload (SalatStealer)", "value": "01ea25aca8ebadaeb560c2d6d976169f8986ca58", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773559384, "uuid": "f8d7630e-e477-480c-bd1f-26f824d0e2a8", "comment": "Malware payload (SalatStealer)", "value": "053660f705b7f0c291435d1640d02fda0c030500d640b7835e0121ec24332226d624c9d1a793b1be358d9781ea3437da", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773559384, "uuid": "8d0d2d1e-28ab-415f-80fb-1bb9c1feeb3f", "value": "T1CCC66C51FA8B64F5E9035936405BA23F63319D048B3CDB9BFB547A2AFC776921837208", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773559384, "uuid": "228da46d-e902-4101-a511-05ff6acfd493", "value": "49152:Qhlct5W+xTXkExMtgcpMVocNAiRuX0h//YhIhLUTANEd6nqvsCcGLpc/XA1D7198:cut5W7ErGqLUNd6qlxcEGnF5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773559384, "uuid": "28dda089-46e7-4fa6-99dc-246c023ed5e3", "value": 12107776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773559384, "uuid": "5a9133e2-e728-43cc-8fad-c5b1315a5192", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773559384, "uuid": "75621e91-e1e5-4481-b78d-e1e529509310", "value": "f9c74ee2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b371f39c-202a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773550319, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773550319, "uuid": "80cd656f-a261-4b7f-822c-a21b34f7bc18", "comment": "Malware payload", "value": "ffe1e170412972ea34c277288c55749b", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "betting", "colour": "#26904C", "exportable": true, "hide_tag": false }, { "name": "Casino", "colour": "#0DF877", "exportable": true, "hide_tag": false }, { "name": "Gambling", "colour": "#80E099", "exportable": true, "hide_tag": false }, { "name": "Pin-Up", "colour": "#1A5CE2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773550319, "uuid": "801f3efc-1254-4fdd-9d58-167fbb82e319", "comment": "Malware payload", "value": "fc075a04586519306868d0089966425e7824be432fc74a1d9e8fa1a5358a1bc7", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "betting", "colour": "#26904C", "exportable": true, "hide_tag": false }, { "name": "Casino", "colour": "#0DF877", "exportable": true, "hide_tag": false }, { "name": "Gambling", "colour": "#80E099", "exportable": true, "hide_tag": false }, { "name": "Pin-Up", "colour": "#1A5CE2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773550319, "uuid": "6c04829f-8166-47f6-a248-300a4055afb7", "comment": "Malware payload", "value": "30f0fe13571e5bde81ad2a54a26c82532b70d46b", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "betting", "colour": "#26904C", "exportable": true, "hide_tag": false }, { "name": "Casino", "colour": "#0DF877", "exportable": true, "hide_tag": false }, { "name": "Gambling", "colour": "#80E099", "exportable": true, "hide_tag": false }, { "name": "Pin-Up", "colour": "#1A5CE2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773550319, "uuid": "863e0742-5a9d-4928-b7f5-ebe54d602066", "comment": "Malware payload", "value": "d8bce1400c92e1dc65b8413c73a4fb7f7c815f84557a5823aca2487d30b7f506d17c7345800504bf18398a2ff82914ff", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "betting", "colour": "#26904C", "exportable": true, "hide_tag": false }, { "name": "Casino", "colour": "#0DF877", "exportable": true, "hide_tag": false }, { "name": "Gambling", "colour": "#80E099", "exportable": true, "hide_tag": false }, { "name": "Pin-Up", "colour": "#1A5CE2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773550319, "uuid": "f4910594-2bdf-48cb-a5fd-d9b1581098d8", "value": "T1BFE5CED6FBD8592FC8774032C9AA52F1165B4D128E839F436948371C78BB6D80F99BC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773550319, "uuid": "e35a653e-73ad-428b-88c8-993bf70a8a1a", "value": "49152:MBziCw9826r43JrPwE162j2Wur/4SDM0dmmp7qpCmqgLCrHS5AhhO:MBza826r43JDwE17yW4UqgLCrHS5AK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773550319, "uuid": "c9a05fcc-0746-4009-8471-743ba4675137", "value": 3071662, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773550319, "uuid": "cd799107-feb0-4b0c-aa33-54506472f9f8", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773550319, "uuid": "ea04cd41-8d8e-472c-a060-8631a2ddd264", "value": "pin-up.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf340bd5-2016-11f1-a769-42010a9c0008", "comment": "Malware payload (DDoSAgent)", "timestamp": 1773541776, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773541776, "uuid": "bc4a4979-259d-4669-a3b2-3c9b195ddd74", "comment": "Malware payload (DDoSAgent)", "value": "06c64b57502a75e2b47baa3a3522309b", "object_relation": "md5", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773541776, "uuid": "3f12231c-0b96-4b62-9f52-4456b39d3844", "comment": "Malware payload (DDoSAgent)", "value": "fdea4b7688114a4edf26deb83a1a24bdd5d3edb3755d28da514f2ff7a7423a66", "object_relation": "sha256", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773541776, "uuid": "d0ce859f-be05-486b-94a3-3f91292d6c9c", "comment": "Malware payload (DDoSAgent)", "value": "a02d3c6aa3ff8c31c4dab3b6f84aee533d06dc95", "object_relation": "sha1", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773541776, "uuid": "8472faab-34de-4fa3-894c-09ffe60db862", "comment": "Malware payload (DDoSAgent)", "value": "abbe9a71ce4d8d073f32f029ad2246e119ef5f1e4ed7910e4c590bcf042303020694959d9e7eb2616b86fee8743e1f30", "object_relation": "sha3-384", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773541776, "uuid": "6e1fe64e-0670-4ca3-bd50-57e30c1abcb9", "value": "T164141A53B7324FA0D326D6720BB38B5659EB01811EE258D1936CC7107B20AEA685FFF5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773541776, "uuid": "7189e894-c095-4727-9f79-07cdec23a2c3", "value": "3072:QmidKgHYArBK7KL1xl3PWP3TV9IPEpEsPkO79z5vnMgWEUprXQ:odKgYArBMmH3Pk9aEusM25nSEkg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773541776, "uuid": "879fe8a0-6bf9-456f-a91d-1f5536de7bd6", "value": 201120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773541776, "uuid": "4070ff79-c509-46da-ae6e-81fb56ff3d9d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773541776, "uuid": "d1ae7a58-4416-49d0-89d5-ccbd62704be0", "value": "data.mips-uclibc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }